Commander1024
94433ef975
- Add admin account list, create, role, delete, and password workflows - Execute identity-checked mutations through the existing dispatcher - Bound queued credential lifetime and wipe transient secrets - Add explicit password generation with saved-value acknowledgement - Handle self-revocation and uncertain outcomes without automatic retries - Register optional account routes without disrupting terminal transports - Expand host regressions and document contracts and pending target checks Validated host suites and pio run; hardware validation remains pending.
54 lines
3.0 KiB
C
54 lines
3.0 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
/* Private, allocation-free parsing only: these helpers do not authorize requests. */
|
|
#pragma once
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#define WEB_AUTH_ORIGIN_CAPACITY 129U
|
|
#define WEB_AUTH_COOKIE_HEADER_MAX 1024U
|
|
#define WEB_AUTH_TOKEN_LENGTH 64U
|
|
#define WEB_AUTH_LOGIN_BODY_MAX 512U
|
|
#define WEB_AUTH_USERNAME_MAX 16U
|
|
#define WEB_AUTH_PASSWORD_MAX 64U
|
|
|
|
typedef struct {
|
|
size_t username_length;
|
|
size_t password_length;
|
|
uint8_t username[WEB_AUTH_USERNAME_MAX + 1U];
|
|
uint8_t password[WEB_AUTH_PASSWORD_MAX + 1U];
|
|
} web_auth_credentials_t;
|
|
|
|
/* Exact byte spans, not necessarily NUL-terminated. Inputs and output must not
|
|
* alias. Failures clear output. Host supports ASCII DNS/IPv4 authorities only;
|
|
* IPv6 literals are deliberately rejected until the device supports that route.
|
|
* Only optional :443 is accepted. Origin is mandatory and must match Host.
|
|
* HTTP callers must separately reject duplicate header lines, enforce methods,
|
|
* body/content-type limits, Fetch Metadata and CSRF/session policy. */
|
|
bool web_auth_parse_origin(const char *host, size_t host_length,
|
|
const char *origin, size_t origin_length,
|
|
char canonical[WEB_AUTH_ORIGIN_CAPACITY]);
|
|
/* Extract exactly one named lowercase-hex token; malformed/duplicate or missing
|
|
* selected cookie fails. Other cookies are syntax-checked but not retained.
|
|
* This deliberately accepts only unquoted cookie values, including unrelated
|
|
* cookies; quoted values fail closed. No whitespace inside a cookie pair.
|
|
* name is a trusted, nonempty C string. Output is sensitive: wipe after use. */
|
|
bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
|
|
char token[WEB_AUTH_TOKEN_LENGTH + 1U]);
|
|
/* As above, but a missing selected cookie is valid with present=false. This
|
|
* lets HTTP policy distinguish absence from malformed/ambiguous cookies. */
|
|
bool web_auth_parse_optional_cookie(const char *header, size_t length, const char *name,
|
|
char token[WEB_AUTH_TOKEN_LENGTH + 1U], bool *present);
|
|
/* Decode one string at *position (including optional JSON whitespace). Capacity
|
|
* includes the terminator. Failure wipes output and leaves position unchanged.
|
|
* Success output is sensitive; caller must wipe it. Same strict decoder as login. */
|
|
bool web_auth_parse_json_string(const char *body, size_t length, size_t *position,
|
|
uint8_t *output, size_t capacity, size_t *decoded_length);
|
|
/* Exactly username/password string fields, either order. JSON escapes and valid
|
|
* UTF-8 accepted; unknown/duplicate fields, NUL and malformed Unicode rejected.
|
|
* Database credential policy remains authoritative. Caller must wipe BOTH the
|
|
* original request body and successful credentials using secure_wipe(). */
|
|
bool web_auth_parse_login(const char *body, size_t length,
|
|
web_auth_credentials_t *credentials);
|