Janady13/missionmatch / internal/modules/auth/service.go

1package auth 2 3import ( 4 "context" 5 "errors" 6 "fmt" 7 8 "github.com/google/uuid" 9 "github.com/jackc/pgx/v5" 10 11 "github.com/missionworkforce/missionmatch/internal/platform/audit" 12 "github.com/missionworkforce/missionmatch/internal/platform/database/dbgen" 13 "github.com/missionworkforce/missionmatch/internal/platform/security" 14 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 15) 16 17// Sentinel errors. Invalid credential and invalid session errors are deliberately generic so neither 18// the response nor its timing reveals whether an account exists. 19var ( 20 ErrNoDatabase = errors.New("auth: no database configured") 21 ErrInvalidCredentials = errors.New("auth: invalid credentials") 22 ErrAccountLocked = errors.New("auth: account temporarily locked") 23 ErrInvalidSession = errors.New("auth: invalid or expired session") 24 ErrInvalidState = errors.New("auth: session is not in the required state") 25 ErrNotFound = errors.New("auth: not found") 26 ErrForbidden = errors.New("auth: not permitted") 27 ErrBadRequest = errors.New("auth: bad request") 28) 29 30const ( 31 maxFailedLogins = 10 // failed password attempts per email and ip before a soft lock 32 maxMFAFailures = 5 // failed MFA attempts before the pending session is revoked 33 failWindowSeconds = 900 // 15 minute brute force window 34 recoveryCodeCount = 10 35) 36 37// reason categories for login_attempts and audit, never the raw email or code. 38const ( 39 reasonNoUser = "no_user" 40 reasonBadPassword = "[credential removed]" 41 reasonLocked = "locked" 42 reasonMFAFailed = "mfa_failed" 43) 44 45// Service implements the authentication and accounts flows. It calls the SECURITY DEFINER functions 46// in migration 0009 over the app pool; those functions are the only path to the secret bearing 47// tables, which the app role cannot read directly. 48type Service struct { 49 deps Deps 50 dummyHash string 51 dummyPepper int 52} 53 54// NewService builds the service and precomputes a dummy password hash so the unknown user login path 55// burns the same PBKDF2 cost as a real verify (no timing oracle). 56func NewService(d Deps) (*Service, error) { 57 if d.Hasher == nil || d.Tagger == nil { 58 return nil, errors.New("auth: hasher and tagger are required") 59 } 60 dummy, version, err := d.Hasher.Hash("missionmatch equal cost dummy secret") 61 if err != nil { 62 return nil, fmt.Errorf("auth: precompute dummy hash: %w", err) 63 } 64 return &Service{deps: d, dummyHash: dummy, dummyPepper: version}, nil 65} 66 67func (s *Service) db() (dbgen.DBTX, error) { 68 if s.deps.DB == nil || s.deps.DB.Pool == nil { 69 return nil, ErrNoDatabase 70 } 71 return s.deps.DB.Pool, nil 72} 73 74// --------------------------------------------------------------------------- 75// Login: password verify then an auth_pending session. 76// --------------------------------------------------------------------------- 77 78type loginRow struct { 79 userID uuid.UUID 80 orgID uuid.UUID 81 role string 82 userStatus string 83 passwordHash string 84 pepperVer int 85 mfaEnrolled bool 86 mfaStatus *string 87 secretCipher []byte 88 secretNonce []byte 89 keyVersion *int 90 lastUsedStep *int64 91} 92 93// Login verifies a password and issues an auth_pending session. The handler sets the returned token 94// as the session cookie and routes the SPA to enroll or verify based on MFAEnrolled. 95func (s *Service) Login(ctx context.Context, in LoginInput, ip, ua string) (LoginResult, error) { 96 db, err := s.db() 97 if err != nil { 98 return LoginResult{}, err 99 } 100 101 locked, err := s.tooManyFailures(ctx, db, in.Email, ip) 102 if err != nil { 103 return LoginResult{}, err 104 } 105 if locked { 106 s.recordAttempt(ctx, db, in.Email, nil, ip, false, reasonLocked) 107 if aerr := s.deps.Audit.System(ctx, audit.Event{Action: "auth.account.locked", IPAddress: ip, UserAgent: ua, EntityType: "email", NewValues: reasonJSON(reasonLocked)}); aerr != nil { 108 return LoginResult{}, aerr 109 } 110 return LoginResult{}, ErrAccountLocked 111 } 112 113 row, found, err := s.lookupLogin(ctx, db, in.Email) 114 if err != nil { 115 return LoginResult{}, err 116 } 117 if !found { 118 // Equal cost dummy verify and identical attempt accounting so existence is not revealed. 119 _, _, _ = s.deps.Hasher.Verify(in.Password, s.dummyHash, s.dummyPepper) 120 s.recordAttempt(ctx, db, in.Email, nil, ip, false, reasonNoUser) 121 if aerr := s.failureAudit(ctx, nil, ip, ua, reasonNoUser); aerr != nil { 122 return LoginResult{}, aerr 123 } 124 return LoginResult{}, ErrInvalidCredentials 125 } 126 127 ok, needsRehash, err := s.deps.Hasher.Verify(in.Password, row.passwordHash, row.pepperVer) 128 if err != nil { 129 return LoginResult{}, err 130 } 131 if !ok { 132 s.recordAttempt(ctx, db, in.Email, &row.orgID, ip, false, reasonBadPassword) 133 actor := row.userID 134 if aerr := s.failureAudit(ctx, &actor, ip, ua, reasonBadPassword); aerr != nil { 135 return LoginResult{}, aerr 136 } 137 return LoginResult{}, ErrInvalidCredentials 138 } 139 140 if needsRehash { 141 if rehash, ver, herr := s.deps.Hasher.Hash(in.Password); herr == nil { 142 _, _ = db.Exec(ctx, `SELECT auth_set_credential($1,$2,$3,$4,$5)`, row.userID, row.orgID, in.Email, rehash, ver) 143 } 144 } 145 146 token, tokenHash, err := security.NewSessionToken() 147 if err != nil { 148 return LoginResult{}, err 149 } 150 if err := s.createInitialSession(ctx, db, tokenHash, row.userID, row.orgID, ip, ua); err != nil { 151 return LoginResult{}, err 152 } 153 154 s.recordAttempt(ctx, db, in.Email, &row.orgID, ip, true, "") 155 actor := row.userID 156 if aerr := s.deps.Audit.System(ctx, audit.Event{Action: "auth.login.success", ActorUserID: &actor, IPAddress: ip, UserAgent: ua}); aerr != nil { 157 return LoginResult{}, aerr 158 } 159 return LoginResult{Token: token, MFAEnrolled: row.mfaEnrolled, MFARequired: !s.deps.MFADisabled}, nil 160} 161 162// createInitialSession issues the first session after a password proof. With MFA required (the default, 163// MFADisabled false) it is a short lived auth_pending session that the MFA routes upgrade to active. 164// With MFA disabled for a pilot (MM_MFA_REQUIRED=false, forbidden in production) it is minted active and 165// MFA satisfied directly, so login is password only and no code path is left half authenticated. 166func (s *Service) createInitialSession(ctx context.Context, db dbgen.DBTX, tokenHash []byte, userID, orgID uuid.UUID, ip, ua string) error { 167 if s.deps.MFADisabled { 168 _, err := db.Exec(ctx, 169 `SELECT auth_create_session($1,$2,$3,'active',true,$4,$5,$6,$7)`, 170 tokenHash, userID, orgID, s.deps.IdleSeconds, s.deps.AbsoluteSeconds, ip, ua) 171 return err 172 } 173 _, err := db.Exec(ctx, 174 `SELECT auth_create_session($1,$2,$3,'auth_pending',false,$4,$4,$5,$6)`, 175 tokenHash, userID, orgID, s.deps.PendingSeconds, ip, ua) 176 return err 177} 178 179// --------------------------------------------------------------------------- 180// MFA: enroll, activate, verify, recover. All run on the pre MFA auth_pending session. 181// --------------------------------------------------------------------------- 182 183// EnrollMFA generates a TOTP secret for a pending session and returns the provisioning material. 184func (s *Service) EnrollMFA(ctx context.Context, token string) (EnrollResult, error) { 185 db, err := s.db() 186 if err != nil { 187 return EnrollResult{}, err 188 } 189 v, err := s.validatePending(ctx, db, token) 190 if err != nil { 191 return EnrollResult{}, err 192 } 193 // Refuse to re enroll an already active authenticator from a pre MFA session. Without this an 194 // attacker holding the password could plant their own secret over the victim's. A genuine reset 195 // goes through the authenticated admin ResetMFA path. The database WHERE status = 'pending' guard 196 // in auth_mfa_enroll is the authoritative defense; this is the early, friendly rejection. 197 if active, err := s.mfaIsActive(ctx, db, v.userID); err != nil { 198 return EnrollResult{}, err 199 } else if active { 200 return EnrollResult{}, ErrInvalidState 201 } 202 email, err := s.credentialEmail(ctx, db, v.userID) 203 if err != nil { 204 return EnrollResult{}, err 205 } 206 secret, err := security.GenerateSecret() 207 if err != nil { 208 return EnrollResult{}, err 209 } 210 kek, ok := s.deps.TOTPKEKs[s.deps.TOTPKEKActive] 211 if !ok { 212 return EnrollResult{}, errors.New("auth: active TOTP key not configured") 213 } 214 ct, nonce, err := security.SealSecret(kek, secret) 215 if err != nil { 216 return EnrollResult{}, err 217 } 218 var enrolled bool 219 if err := db.QueryRow(ctx, `SELECT auth_mfa_enroll($1,$2,$3,$4,$5)`, 220 v.userID, v.orgID, ct, nonce, s.deps.TOTPKEKActive).Scan(&enrolled); err != nil { 221 return EnrollResult{}, err 222 } 223 if !enrolled { 224 // The row was already active, so the pending overwrite wrote nothing. Fail closed. 225 return EnrollResult{}, ErrInvalidState 226 } 227 uri := security.ProvisioningURI(secret, email, s.deps.TOTPIssuer) 228 return EnrollResult{OTPAuthURI: uri, Secret: security.EncodeSecret(secret)}, nil 229} 230 231// mfaIsActive reports whether the user already has an active TOTP secret. 232func (s *Service) mfaIsActive(ctx context.Context, db dbgen.DBTX, userID string) (bool, error) { 233 var ct, nonce []byte 234 var keyVer int 235 var status string 236 var lastStep int64 237 err := db.QueryRow(ctx, `SELECT secret_ciphertext, secret_nonce, key_version, status, last_used_step FROM auth_mfa_get($1)`, mustUUID(userID)). 238 Scan(&ct, &nonce, &keyVer, &status, &lastStep) 239 if errors.Is(err, pgx.ErrNoRows) { 240 return false, nil 241 } 242 if err != nil { 243 return false, err 244 } 245 return status == "active", nil 246} 247 248// ActivateMFA verifies the first code, activates the secret, upgrades the session to active, and 249// returns the one time recovery codes. It is the ONLY transition that sets mfa_enrolled and yields an 250// active, MFA satisfied session. 251func (s *Service) ActivateMFA(ctx context.Context, token string, in CodeInput, ip, ua string) (ActivateResult, error) { 252 db, err := s.db() 253 if err != nil { 254 return ActivateResult{}, err 255 } 256 v, err := s.validatePending(ctx, db, token) 257 if err != nil { 258 return ActivateResult{}, err 259 } 260 used, err := s.verifyTOTPCode(ctx, db, v.userID, in.Code, "pending") 261 if err != nil { 262 return ActivateResult{}, err 263 } 264 265 codes, hashes, versions, tags, err := s.buildRecoveryCodes() 266 if err != nil { 267 return ActivateResult{}, err 268 } 269 270 newToken, newHash, err := security.NewSessionToken() 271 if err != nil { 272 return ActivateResult{}, err 273 } 274 275 err = s.inTx(ctx, db, func(tx pgx.Tx) error { 276 var advanced int 277 if e := tx.QueryRow(ctx, `SELECT auth_mfa_advance_step($1,$2)`, v.userID, used).Scan(&advanced); e != nil { 278 return e 279 } 280 if advanced == 0 { 281 return ErrInvalidCredentials // the activation code was already consumed concurrently 282 } 283 var activated bool 284 if e := tx.QueryRow(ctx, `SELECT auth_mfa_activate($1)`, v.userID).Scan(&activated); e != nil { 285 return e 286 } 287 if !activated { 288 return ErrInvalidState 289 } 290 if _, e := tx.Exec(ctx, `SELECT auth_recovery_store($1,$2,$3,$4,$5)`, v.userID, v.orgID, hashes, versions, tags); e != nil { 291 return e 292 } 293 return rotate(ctx, tx, s.tokenHash(token), newHash, true, s.deps.IdleSeconds, s.deps.AbsoluteSeconds, ip, ua) 294 }) 295 if err != nil { 296 return ActivateResult{}, err 297 } 298 actor := mustUUID(v.userID) 299 _ = s.deps.Audit.System(ctx, audit.Event{Action: "auth.mfa.activated", ActorUserID: &actor, IPAddress: ip, UserAgent: ua}) 300 return ActivateResult{Token: newToken, RecoveryCodes: codes}, nil 301} 302 303// VerifyTOTP verifies a code for an already enrolled user and upgrades the pending session to active. 304func (s *Service) VerifyTOTP(ctx context.Context, token string, in CodeInput, ip, ua string) (TokenResult, error) { 305 db, err := s.db() 306 if err != nil { 307 return TokenResult{}, err 308 } 309 v, err := s.validatePending(ctx, db, token) 310 if err != nil { 311 return TokenResult{}, err 312 } 313 used, verr := s.verifyTOTPCode(ctx, db, v.userID, in.Code, "active") 314 if verr != nil { 315 if aerr := s.afterMFAFailure(ctx, db, v, token, ip, ua); aerr != nil { 316 return TokenResult{}, aerr 317 } 318 return TokenResult{}, ErrInvalidCredentials 319 } 320 newToken, err := s.advanceAndRotate(ctx, db, v, token, used, ip, ua, "auth.mfa.verify.success") 321 if err != nil { 322 return TokenResult{}, err 323 } 324 return TokenResult{Token: newToken}, nil 325} 326 327// RecoverMFA consumes a single use recovery code to upgrade the pending session to active. 328func (s *Service) RecoverMFA(ctx context.Context, token string, in CodeInput, ip, ua string) (TokenResult, error) { 329 db, err := s.db() 330 if err != nil { 331 return TokenResult{}, err 332 } 333 v, err := s.validatePending(ctx, db, token) 334 if err != nil { 335 return TokenResult{}, err 336 } 337 tag := s.deps.Tagger.Tag(in.Code) 338 var id uuid.UUID 339 var codeHash string 340 var ver int 341 err = db.QueryRow(ctx, `SELECT id, code_hash, pepper_version FROM auth_recovery_lookup($1,$2)`, v.userID, tag).Scan(&id, &codeHash, &ver) 342 if errors.Is(err, pgx.ErrNoRows) { 343 if aerr := s.afterMFAFailure(ctx, db, v, token, ip, ua); aerr != nil { 344 return TokenResult{}, aerr 345 } 346 return TokenResult{}, ErrInvalidCredentials 347 } 348 if err != nil { 349 return TokenResult{}, err 350 } 351 ok, _, err := s.deps.Hasher.Verify(in.Code, codeHash, ver) 352 if err != nil { 353 return TokenResult{}, err 354 } 355 if !ok { 356 if aerr := s.afterMFAFailure(ctx, db, v, token, ip, ua); aerr != nil { 357 return TokenResult{}, aerr 358 } 359 return TokenResult{}, ErrInvalidCredentials 360 } 361 362 newToken, newHash, err := security.NewSessionToken() 363 if err != nil { 364 return TokenResult{}, err 365 } 366 err = s.inTx(ctx, db, func(tx pgx.Tx) error { 367 var claimed int 368 if e := tx.QueryRow(ctx, `SELECT auth_recovery_claim($1)`, id).Scan(&claimed); e != nil { 369 return e 370 } 371 if claimed == 0 { 372 return ErrInvalidCredentials // already spent by a concurrent attempt 373 } 374 return rotate(ctx, tx, s.tokenHash(token), newHash, true, s.deps.IdleSeconds, s.deps.AbsoluteSeconds, ip, ua) 375 }) 376 if err != nil { 377 return TokenResult{}, err 378 } 379 actor := mustUUID(v.userID) 380 _ = s.deps.Audit.System(ctx, audit.Event{Action: "auth.mfa.recovery_code.used", ActorUserID: &actor, IPAddress: ip, UserAgent: ua}) 381 return TokenResult{Token: newToken}, nil 382} 383 384// --------------------------------------------------------------------------- 385// Session lifecycle. 386// --------------------------------------------------------------------------- 387 388// Logout revokes the presented session. 389func (s *Service) Logout(ctx context.Context, token string, ip, ua string) error { 390 db, err := s.db() 391 if err != nil { 392 return err 393 } 394 if _, err := db.Exec(ctx, `SELECT auth_revoke_session($1)`, s.tokenHash(token)); err != nil { 395 return err 396 } 397 _ = s.deps.Audit.System(ctx, audit.Event{Action: "auth.logout", IPAddress: ip, UserAgent: ua}) 398 return nil 399} 400 401// LogoutAll revokes every session of the authenticated user except the current one. 402func (s *Service) LogoutAll(ctx context.Context, token string) error { 403 db, err := s.db() 404 if err != nil { 405 return err 406 } 407 p, ok := tenant.UserFromContext(ctx) 408 if !ok { 409 return ErrForbidden 410 } 411 if _, err := db.Exec(ctx, `SELECT auth_revoke_user_sessions($1,$2)`, mustUUID(p.UserID), s.tokenHash(token)); err != nil { 412 return err 413 } 414 return nil 415} 416 417// ChangePassword verifies the old password, rehashes the new one, revokes all other sessions, and 418// rotates the current session to a fresh token. 419func (s *Service) ChangePassword(ctx context.Context, token string, in ChangePasswordInput, ip, ua string) (TokenResult, error) { 420 db, err := s.db() 421 if err != nil { 422 return TokenResult{}, err 423 } 424 p, ok := tenant.UserFromContext(ctx) 425 if !ok { 426 return TokenResult{}, ErrForbidden 427 } 428 uid := mustUUID(p.UserID) 429 var orgID uuid.UUID 430 var email, hash string 431 var ver int 432 err = db.QueryRow(ctx, `SELECT organization_id, email_normalized, password_hash, pepper_version FROM auth_get_credential($1)`, uid). 433 Scan(&orgID, &email, &hash, &ver) 434 if errors.Is(err, pgx.ErrNoRows) { 435 return TokenResult{}, ErrNotFound 436 } 437 if err != nil { 438 return TokenResult{}, err 439 } 440 okOld, _, err := s.deps.Hasher.Verify(in.OldPassword, hash, ver) 441 if err != nil { 442 return TokenResult{}, err 443 } 444 if !okOld { 445 return TokenResult{}, ErrInvalidCredentials 446 } 447 newHash, newVer, err := s.deps.Hasher.Hash(in.NewPassword) 448 if err != nil { 449 return TokenResult{}, err // includes ErrPasswordTooLong 450 } 451 newToken, newSessHash, err := security.NewSessionToken() 452 if err != nil { 453 return TokenResult{}, err 454 } 455 err = s.inTx(ctx, db, func(tx pgx.Tx) error { 456 if _, e := tx.Exec(ctx, `SELECT auth_set_credential($1,$2,$3,$4,$5)`, uid, orgID, email, newHash, newVer); e != nil { 457 return e 458 } 459 if _, e := tx.Exec(ctx, `SELECT auth_revoke_user_sessions($1,$2)`, uid, s.tokenHash(token)); e != nil { 460 return e 461 } 462 return rotate(ctx, tx, s.tokenHash(token), newSessHash, true, s.deps.IdleSeconds, s.deps.AbsoluteSeconds, ip, ua) 463 }) 464 if err != nil { 465 return TokenResult{}, err 466 } 467 _ = s.deps.Audit.System(ctx, audit.Event{Action: "auth.password.changed", ActorUserID: &uid, IPAddress: ip, UserAgent: ua}) 468 return TokenResult{Token: newToken}, nil 469} 470 471// --------------------------------------------------------------------------- 472// Internal helpers. 473// --------------------------------------------------------------------------- 474 475type pendingSession struct { 476 sessionID string 477 userID string 478 orgID string 479 role string 480} 481 482// validatePending validates a session and requires it to be auth_pending (password verified, MFA not 483// yet satisfied). It is the gate for the MFA routes. 484func (s *Service) validatePending(ctx context.Context, db dbgen.DBTX, token string) (pendingSession, error) { 485 v, err := s.validate(ctx, db, token) 486 if err != nil { 487 return pendingSession{}, err 488 } 489 if v.state != "auth_pending" { 490 return pendingSession{}, ErrInvalidState 491 } 492 return pendingSession{sessionID: v.sessionID, userID: v.userID, orgID: v.orgID, role: v.role}, nil 493} 494 495type validatedSession struct { 496 sessionID string 497 userID string 498 orgID string 499 role string 500 state string 501 mfaSatisfied bool 502 userStatus string 503} 504 505// validate runs the atomic validate, slide, and revocation check. No row means invalid. 506func (s *Service) validate(ctx context.Context, db dbgen.DBTX, token string) (validatedSession, error) { 507 var sid, uid, oid uuid.UUID 508 var v validatedSession 509 err := db.QueryRow(ctx, `SELECT session_id, user_id, organization_id, role, state, mfa_satisfied, user_status FROM auth_validate_session($1,$2)`, 510 s.tokenHash(token), s.deps.IdleSeconds).Scan(&sid, &uid, &oid, &v.role, &v.state, &v.mfaSatisfied, &v.userStatus) 511 if errors.Is(err, pgx.ErrNoRows) { 512 return validatedSession{}, ErrInvalidSession 513 } 514 if err != nil { 515 return validatedSession{}, err 516 } 517 v.sessionID, v.userID, v.orgID = sid.String(), uid.String(), oid.String() 518 return v, nil 519} 520 521// Validate is the resolver facing check: it returns the principal only for an active, MFA satisfied 522// session, so a pre MFA session can never reach a tenant route. 523func (s *Service) Validate(ctx context.Context, token string) (tenant.Principal, string, error) { 524 db, err := s.db() 525 if err != nil { 526 return tenant.Principal{}, "", err 527 } 528 v, err := s.validate(ctx, db, token) 529 if err != nil { 530 return tenant.Principal{}, "", err 531 } 532 if v.state != "active" || !v.mfaSatisfied || v.orgID == "" { 533 return tenant.Principal{}, "", ErrInvalidSession 534 } 535 return tenant.Principal{UserID: v.userID, Role: v.role}, v.orgID, nil 536} 537 538func (s *Service) verifyTOTPCode(ctx context.Context, db dbgen.DBTX, userID, code, wantStatus string) (int64, error) { 539 var ct, nonce []byte 540 var keyVer int 541 var status string 542 var lastStep int64 543 err := db.QueryRow(ctx, `SELECT secret_ciphertext, secret_nonce, key_version, status, last_used_step FROM auth_mfa_get($1)`, mustUUID(userID)). 544 Scan(&ct, &nonce, &keyVer, &status, &lastStep) 545 if errors.Is(err, pgx.ErrNoRows) { 546 return 0, ErrInvalidState 547 } 548 if err != nil { 549 return 0, err 550 } 551 if status != wantStatus { 552 return 0, ErrInvalidState 553 } 554 kek, ok := s.deps.TOTPKEKs[keyVer] 555 if !ok { 556 return 0, fmt.Errorf("auth: TOTP key version %d not configured", keyVer) 557 } 558 secret, err := security.OpenSecret(kek, ct, nonce) 559 if err != nil { 560 return 0, err 561 } 562 ok, used := s.deps.TOTP.Validate(secret, code, nowFn(), lastStep) 563 if !ok { 564 return 0, ErrInvalidCredentials 565 } 566 return used, nil 567} 568 569func (s *Service) advanceAndRotate(ctx context.Context, db dbgen.DBTX, v pendingSession, oldToken string, used int64, ip, ua, action string) (string, error) { 570 newToken, newHash, err := security.NewSessionToken() 571 if err != nil { 572 return "", err 573 } 574 err = s.inTx(ctx, db, func(tx pgx.Tx) error { 575 // Advancing the monotonic step is the authoritative single use gate. If a concurrent verify 576 // already consumed this step the update affects zero rows, so we abort and mint no session. 577 var advanced int 578 if e := tx.QueryRow(ctx, `SELECT auth_mfa_advance_step($1,$2)`, mustUUID(v.userID), used).Scan(&advanced); e != nil { 579 return e 580 } 581 if advanced == 0 { 582 return ErrInvalidCredentials 583 } 584 return rotate(ctx, tx, s.tokenHash(oldToken), newHash, true, s.deps.IdleSeconds, s.deps.AbsoluteSeconds, ip, ua) 585 }) 586 if err != nil { 587 return "", err 588 } 589 actor := mustUUID(v.userID) 590 _ = s.deps.Audit.System(ctx, audit.Event{Action: action, ActorUserID: &actor, IPAddress: ip, UserAgent: ua}) 591 return newToken, nil 592} 593 594// afterMFAFailure records a failed MFA attempt and revokes the pending session once the per account 595// and ip budget is exhausted, forcing a fresh password login (the limiter is not reset by re login). 596// Its security audit writes fail closed, matching the login failure path: if the trail cannot be 597// written the request surfaces that error rather than proceeding with the attempt unrecorded. 598func (s *Service) afterMFAFailure(ctx context.Context, db dbgen.DBTX, v pendingSession, token, ip, ua string) error { 599 email, err := s.credentialEmail(ctx, db, v.userID) 600 if err != nil { 601 email = v.userID // fall back to a stable non secret key 602 } 603 s.recordAttempt(ctx, db, email, orgPtr(v.orgID), ip, false, reasonMFAFailed) 604 actor := mustUUID(v.userID) 605 if aerr := s.deps.Audit.System(ctx, audit.Event{Action: "auth.mfa.verify.failure", ActorUserID: &actor, IPAddress: ip, UserAgent: ua}); aerr != nil { 606 return aerr 607 } 608 count, cerr := s.failureCount(ctx, db, email, ip, reasonMFAFailed) 609 if cerr == nil && count >= maxMFAFailures { 610 if _, derr := db.Exec(ctx, `SELECT auth_revoke_session($1)`, s.tokenHash(token)); derr != nil { 611 return derr 612 } 613 if aerr := s.deps.Audit.System(ctx, audit.Event{Action: "auth.mfa.pending_session.revoked", ActorUserID: &actor, IPAddress: ip, UserAgent: ua}); aerr != nil { 614 return aerr 615 } 616 } 617 return nil 618} 619 620func (s *Service) buildRecoveryCodes() (codes []string, hashes []string, versions []int, tags [][]byte, err error) { 621 codes, err = security.GenerateRecoveryCodes(recoveryCodeCount) 622 if err != nil { 623 return nil, nil, nil, nil, err 624 } 625 for _, c := range codes { 626 h, ver, herr := s.deps.Hasher.Hash(c) 627 if herr != nil { 628 return nil, nil, nil, nil, herr 629 } 630 hashes = append(hashes, h) 631 versions = append(versions, ver) 632 tags = append(tags, s.deps.Tagger.Tag(c)) 633 } 634 return codes, hashes, versions, tags, nil 635} 636 637func (s *Service) lookupLogin(ctx context.Context, db dbgen.DBTX, email string) (loginRow, bool, error) { 638 var r loginRow 639 err := db.QueryRow(ctx, `SELECT user_id, organization_id, role, user_status, password_hash, pepper_version, mfa_enrolled, mfa_status, mfa_secret_ciphertext, mfa_secret_nonce, mfa_key_version, last_used_step FROM auth_lookup_login($1)`, email). 640 Scan(&r.userID, &r.orgID, &r.role, &r.userStatus, &r.passwordHash, &r.pepperVer, &r.mfaEnrolled, &r.mfaStatus, &r.secretCipher, &r.secretNonce, &r.keyVersion, &r.lastUsedStep) 641 if errors.Is(err, pgx.ErrNoRows) { 642 return loginRow{}, false, nil 643 } 644 if err != nil { 645 return loginRow{}, false, err 646 } 647 if r.userStatus != "active" && r.userStatus != "invited" { 648 return loginRow{}, false, nil // disabled accounts cannot log in; treated as not found 649 } 650 return r, true, nil 651} 652 653func (s *Service) credentialEmail(ctx context.Context, db dbgen.DBTX, userID string) (string, error) { 654 var org uuid.UUID 655 var email, hash string 656 var ver int 657 err := db.QueryRow(ctx, `SELECT organization_id, email_normalized, password_hash, pepper_version FROM auth_get_credential($1)`, mustUUID(userID)). 658 Scan(&org, &email, &hash, &ver) 659 if err != nil { 660 return "", err 661 } 662 return email, nil 663} 664 665func (s *Service) recordAttempt(ctx context.Context, db dbgen.DBTX, email string, org *uuid.UUID, ip string, ok bool, reason string) { 666 var reasonPtr *string 667 if reason != "" { 668 reasonPtr = &reason 669 } 670 _, _ = db.Exec(ctx, 671 `INSERT INTO login_attempts (email_normalized, organization_id, ip_address, succeeded, reason) VALUES (lower($1),$2,$3,$4,$5)`, 672 email, org, nullStr(ip), ok, reasonPtr) 673} 674 675func (s *Service) tooManyFailures(ctx context.Context, db dbgen.DBTX, email, ip string) (bool, error) { 676 n, err := s.failureCount(ctx, db, email, ip, reasonBadPassword) 677 if err != nil { 678 return false, err 679 } 680 return n >= maxFailedLogins, nil 681} 682 683func (s *Service) failureCount(ctx context.Context, db dbgen.DBTX, email, ip, reason string) (int, error) { 684 var n int 685 err := db.QueryRow(ctx, 686 `SELECT count(*) FROM login_attempts WHERE email_normalized = lower($1) AND succeeded = false AND reason = $2 AND (ip_address = $3 OR $3 IS NULL) AND created_at > now() - make_interval(secs => $4)`, 687 email, reason, nullStr(ip), failWindowSeconds).Scan(&n) 688 return n, err 689} 690 691func (s *Service) failureAudit(ctx context.Context, actor *uuid.UUID, ip, ua, reason string) error { 692 return s.deps.Audit.System(ctx, audit.Event{ 693 Action: "auth.login.failure", ActorUserID: actor, IPAddress: ip, UserAgent: ua, 694 EntityType: "login", NewValues: reasonJSON(reason), 695 }) 696} 697 698func (s *Service) tokenHash(token string) []byte { return security.HashSessionToken(token) } 699 700func (s *Service) inTx(ctx context.Context, db dbgen.DBTX, fn func(tx pgx.Tx) error) (err error) { 701 pool, ok := db.(interface { 702 Begin(context.Context) (pgx.Tx, error) 703 }) 704 if !ok { 705 return errors.New("auth: pool does not support transactions") 706 } 707 tx, err := pool.Begin(ctx) 708 if err != nil { 709 return err 710 } 711 defer func() { _ = tx.Rollback(ctx) }() 712 if err = fn(tx); err != nil { 713 return err 714 } 715 return tx.Commit(ctx) 716} 717 718// rotate revokes the old token and mints a new one in one definer call. 719func rotate(ctx context.Context, tx pgx.Tx, oldHash, newHash []byte, mfaSatisfied bool, idle, absolute int, ip, ua string) error { 720 var sid uuid.UUID 721 var idleExp, absExp interface{} 722 err := tx.QueryRow(ctx, 723 `SELECT session_id, idle_expires_at, absolute_expires_at FROM auth_rotate_session($1,$2,'active',$3,$4,$5,$6,$7)`, 724 oldHash, newHash, mfaSatisfied, idle, absolute, nullStr(ip), nullStr(ua)).Scan(&sid, &idleExp, &absExp) 725 if errors.Is(err, pgx.ErrNoRows) { 726 return ErrInvalidSession 727 } 728 return err 729} 730