77 lines
3.3 KiB
C
77 lines
3.3 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
/* Internal session primitives; no HTTP authorization is enabled by this module. */
|
|
#pragma once
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
#include "esp_err.h"
|
|
#include "user_database.h"
|
|
|
|
#define WEB_SESSION_STORE_CAPACITY 4U
|
|
#define WEB_SESSION_STORE_SECRET_BYTES 32U
|
|
#define WEB_SESSION_STORE_TOKEN_LENGTH 64U
|
|
#define WEB_SESSION_STORE_ORIGIN_MAX_LENGTH 128U
|
|
#define WEB_SESSION_STORE_LIFETIME_US 3600000000LL
|
|
|
|
typedef uint64_t web_session_id_t;
|
|
|
|
/* Sensitive request-local result, NOT a routine snapshot. Wipe after use. */
|
|
typedef struct {
|
|
web_session_id_t id;
|
|
int64_t expires_at_us;
|
|
user_principal_t principal;
|
|
char csrf[WEB_SESSION_STORE_TOKEN_LENGTH + 1U];
|
|
} web_session_view_t;
|
|
|
|
typedef struct {
|
|
bool initialized;
|
|
uint32_t active;
|
|
uint32_t issued;
|
|
uint32_t capacity_rejections;
|
|
uint32_t expired;
|
|
uint32_t invalidated;
|
|
uint32_t lookup_rejections;
|
|
uint32_t init_failures;
|
|
size_t storage_bytes;
|
|
size_t slot_bytes;
|
|
} web_session_store_snapshot_t;
|
|
|
|
/* Idempotent; probes the already-seeded shared RNG, never seeds it here.
|
|
* Stop cancels in-flight initialization/issuance and wipes all records. IDs and
|
|
* invalidation epochs never reset within a boot, even across stop/init. */
|
|
esp_err_t web_session_store_init(void);
|
|
void web_session_store_stop(void);
|
|
|
|
/* Trusted callers only. principal must be a current password-authenticated
|
|
* principal. origin is the canonical, already HTTP-policy-validated HTTPS
|
|
* origin, not an unchecked Host header; this module only binds its digest.
|
|
* No live eviction. ESP_ERR_NO_MEM means fixed session capacity exhausted.
|
|
* Raw token is returned only by issue; both outputs must be wiped by caller.
|
|
* Output buffers must not alias inputs or each other. */
|
|
esp_err_t web_session_store_issue(
|
|
const user_principal_t *principal, const char *origin, size_t origin_length,
|
|
char token[WEB_SESSION_STORE_TOKEN_LENGTH + 1U], web_session_view_t *view);
|
|
esp_err_t web_session_store_lookup(
|
|
const char *token, size_t token_length, const char *origin,
|
|
size_t origin_length, web_session_view_t *view);
|
|
|
|
/* Trusted transport identity check, not a replacement for HTTP cookie/origin
|
|
* authorization. Every successful lookup/check revalidates the principal.
|
|
* No API result is a lease: recheck at later sensitive boundaries. */
|
|
esp_err_t web_session_store_is_current(web_session_id_t id, bool *current);
|
|
/* Also verifies that the transport's copied principal belongs to this ID. */
|
|
esp_err_t web_session_store_check_principal(web_session_id_t id,
|
|
const user_principal_t *principal,
|
|
bool *current);
|
|
void web_session_store_invalidate(web_session_id_t id);
|
|
void web_session_store_invalidate_user(uint32_t user_id);
|
|
/* Command notifications use names, including after account deletion. NULL/0
|
|
* invalidates all records without disabling the store. */
|
|
void web_session_store_invalidate_username(const uint8_t *username, size_t length);
|
|
void web_session_store_prune(void);
|
|
|
|
/* Counts only: never token/digest/CSRF/principal material. Expired records are
|
|
* reclaimed here; stale principals are reclaimed by prune or lookup/check. */
|
|
esp_err_t web_session_store_get_snapshot(web_session_store_snapshot_t *snapshot);
|