popertots
f9e8385d5a
- TWO_FACTOR_ALLOW_LOG_DELIVERY production opt-in REMOVED: plaintext codes are written to the stdout log ([2FA]/[VERIFY]) only in dev/test builds as a local DEV ONLY feature while email/SMS delivery (P6) is implemented. Production builds have no delivery channel and code issuance fails closed (503) under any configuration — no silent log-based code leak - verification/2FA codes hashed at rest (HMAC-SHA256 via TWO_FACTOR_PEPPER, CHAR(64)); [VERIFY] dev log relay; per-user brute-force budget; password_reset purpose clears lockout for self-service recovery; dummy-bcrypt on login no-user path kills timing oracle - sabredav weak-password list + entropy gate; .env.example ships fail-closed DAV_ADMIN_PASSWORD - delete-account re-auth (current_password + fresh 2FA code when enforced) - prod-tag suite (run-prod-tag-tests.sh) compiles and runs the production 2FA issuance gate: production ALWAYS reports no delivery channel and refuses issuance after the pepper check - startup_checks_test SNAPSHOT_ENC_KEY values built at runtime so gitleaks sees no secret-shaped literals - env-docs parity updated (flag removed, 38 vars)
70 lines
3.1 KiB
Go
70 lines
3.1 KiB
Go
//go:build dev || test
|
|
|
|
package user
|
|
|
|
// Dev/test builds (the `dev` tag, or any build with the `test` tag) deliver 2FA
|
|
// codes to the LOCAL DEV stdout log ([2FA] prefix) as the stand-in for the
|
|
// not-yet-wired email/SMS transport (P6), and a missing TWO_FACTOR_PEPPER still
|
|
// falls back to the legacy unsalted SHA-256 digest. Production builds
|
|
// (!dev && !test) instead NEVER log the code — log delivery is a dev/test-only
|
|
// local feature, never a production channel — and fail closed without the
|
|
// pepper — see twofa_prod.go.
|
|
|
|
import (
|
|
"crussell/internal/twofa"
|
|
"log"
|
|
"os"
|
|
"sync"
|
|
)
|
|
|
|
// twoFAPepperWarnOnce guards the one-time warning when TWO_FACTOR_PEPPER is
|
|
// unset, so a misconfigured deployment is loudly flagged once rather than on
|
|
// every code operation. Dev/test only: production builds fail closed at
|
|
// issuance instead.
|
|
var twoFAPepperWarnOnce sync.Once
|
|
|
|
// init registers the dev/test pepper reader into the shared verification core
|
|
// (crussell/internal/twofa): the documented loose-fake fallback — the legacy
|
|
// unsalted SHA-256 digest with a one-time warning when TWO_FACTOR_PEPPER is
|
|
// unset. Production builds fail closed instead (twofa_prod.go).
|
|
func init() {
|
|
twofa.SetPepperProvider(func() string {
|
|
pepper := os.Getenv(twoFAPepperEnv)
|
|
if pepper == "" {
|
|
twoFAPepperWarnOnce.Do(func() {
|
|
log.Printf("WARNING: TWO_FACTOR_PEPPER unset — 2FA codes hashed without an HMAC pepper (falling back to unsalted SHA-256); set TWO_FACTOR_PEPPER in production so a leaked digest cannot be brute-forced offline")
|
|
})
|
|
}
|
|
return pepper
|
|
})
|
|
}
|
|
|
|
// twoFAEnsureIssueAllowed always permits code issuance in dev/test builds: the
|
|
// loose-fake delivery (the [2FA] log line) is the documented stand-in until the
|
|
// email/SMS transport is wired (P6). Production builds fail closed here — no
|
|
// TWO_FACTOR_PEPPER, no codes (see twofa_prod.go).
|
|
func twoFAEnsureIssueAllowed() error { return nil }
|
|
|
|
// twoFADeliverCode delivers a fresh verification code to the user. Dev/test:
|
|
// the [2FA] log line is the LOCAL DEV delivery channel — an operator (or the
|
|
// developer) relays the code to the user out-of-band until email/SMS lands
|
|
// (P6). Production builds NEVER log it (see twofa_prod.go) and refuse issuance
|
|
// up front — stdout-log delivery is a dev/test-only feature.
|
|
//
|
|
// MEDIUM-3b: the user id and the plaintext code are written to SEPARATE log
|
|
// lines so a log line cannot trivially pair a code with its owner. The two
|
|
// lines are still correlated by proximity, but a single-line grep or a log
|
|
// redaction rule that masks a "code" pattern no longer discloses the identity
|
|
// in the same record.
|
|
func twoFADeliverCode(userID, label, code string) {
|
|
log.Printf("[2FA] code delivery requested (user=%s, purpose=%s)", userID, label)
|
|
log.Printf("[2FA] code: %s", code)
|
|
}
|
|
|
|
// twoFADeliveryAvailable reports whether a 2FA code delivery channel exists in
|
|
// this build. Dev/test: always true — the [2FA] log line is the delivery
|
|
// channel. Production builds only have a channel when the operator explicitly
|
|
// opted into log delivery or a real email/SMS transport is wired (P6) — see
|
|
// twofa_prod.go.
|
|
func twoFADeliveryAvailable() bool { return true }
|