2022-10-04 13:12:54 +03:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2022 Yubico.
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
2023-05-12 12:38:56 +03:00
|
|
|
import 'dart:typed_data';
|
|
|
|
import 'dart:convert';
|
|
|
|
import 'package:base32/base32.dart';
|
2021-11-19 17:05:57 +03:00
|
|
|
import 'package:freezed_annotation/freezed_annotation.dart';
|
2023-03-02 16:49:02 +03:00
|
|
|
import 'package:flutter_gen/gen_l10n/app_localizations.dart';
|
2021-11-19 17:05:57 +03:00
|
|
|
|
2022-05-25 19:24:45 +03:00
|
|
|
import '../core/models.dart';
|
|
|
|
|
2021-11-19 17:05:57 +03:00
|
|
|
part 'models.freezed.dart';
|
|
|
|
part 'models.g.dart';
|
|
|
|
|
2022-01-28 19:05:05 +03:00
|
|
|
const defaultPeriod = 30;
|
|
|
|
const defaultDigits = 6;
|
|
|
|
const defaultCounter = 0;
|
|
|
|
const defaultOathType = OathType.totp;
|
|
|
|
const defaultHashAlgorithm = HashAlgorithm.sha1;
|
|
|
|
|
2021-11-19 17:05:57 +03:00
|
|
|
enum HashAlgorithm {
|
|
|
|
@JsonValue(0x01)
|
2022-06-07 15:12:41 +03:00
|
|
|
sha1('SHA-1'),
|
2021-11-19 17:05:57 +03:00
|
|
|
@JsonValue(0x02)
|
2022-06-07 15:12:41 +03:00
|
|
|
sha256('SHA-256'),
|
2021-11-19 17:05:57 +03:00
|
|
|
@JsonValue(0x03)
|
2022-06-07 15:12:41 +03:00
|
|
|
sha512('SHA-512');
|
|
|
|
|
|
|
|
final String displayName;
|
|
|
|
const HashAlgorithm(this.displayName);
|
2021-11-19 17:05:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
enum OathType {
|
|
|
|
@JsonValue(0x10)
|
2023-03-02 16:49:02 +03:00
|
|
|
hotp,
|
2021-11-19 17:05:57 +03:00
|
|
|
@JsonValue(0x20)
|
2023-03-02 16:49:02 +03:00
|
|
|
totp;
|
2022-06-07 15:12:41 +03:00
|
|
|
|
2023-03-02 16:49:02 +03:00
|
|
|
const OathType();
|
|
|
|
|
2023-05-22 12:52:49 +03:00
|
|
|
String getDisplayName(AppLocalizations l10n) => switch (this) {
|
|
|
|
OathType.hotp => l10n.s_counter_based,
|
|
|
|
OathType.totp => l10n.s_time_based
|
|
|
|
};
|
2021-11-19 17:05:57 +03:00
|
|
|
}
|
|
|
|
|
2022-02-22 17:22:41 +03:00
|
|
|
enum KeystoreState { unknown, allowed, failed }
|
|
|
|
|
2021-11-19 17:05:57 +03:00
|
|
|
@freezed
|
|
|
|
class OathCredential with _$OathCredential {
|
|
|
|
factory OathCredential(
|
|
|
|
String deviceId,
|
|
|
|
String id,
|
|
|
|
String? issuer,
|
|
|
|
String name,
|
|
|
|
OathType oathType,
|
|
|
|
int period,
|
|
|
|
bool touchRequired) = _OathCredential;
|
|
|
|
|
|
|
|
factory OathCredential.fromJson(Map<String, dynamic> json) =>
|
|
|
|
_$OathCredentialFromJson(json);
|
|
|
|
}
|
|
|
|
|
|
|
|
@freezed
|
|
|
|
class OathCode with _$OathCode {
|
|
|
|
factory OathCode(String value, int validFrom, int validTo) = _OathCode;
|
|
|
|
|
|
|
|
factory OathCode.fromJson(Map<String, dynamic> json) =>
|
|
|
|
_$OathCodeFromJson(json);
|
|
|
|
}
|
|
|
|
|
|
|
|
@freezed
|
|
|
|
class OathPair with _$OathPair {
|
|
|
|
factory OathPair(OathCredential credential, OathCode? code) = _OathPair;
|
2022-05-06 15:27:33 +03:00
|
|
|
|
|
|
|
factory OathPair.fromJson(Map<String, dynamic> json) =>
|
|
|
|
_$OathPairFromJson(json);
|
2021-11-19 17:05:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
@freezed
|
|
|
|
class OathState with _$OathState {
|
2022-02-08 14:25:36 +03:00
|
|
|
factory OathState(
|
2022-05-25 19:24:45 +03:00
|
|
|
String deviceId,
|
|
|
|
Version version, {
|
2022-02-08 14:25:36 +03:00
|
|
|
required bool hasKey,
|
|
|
|
required bool remembered,
|
|
|
|
required bool locked,
|
2022-02-22 17:22:41 +03:00
|
|
|
required KeystoreState keystore,
|
2022-02-08 14:25:36 +03:00
|
|
|
}) = _OathState;
|
2021-11-19 17:05:57 +03:00
|
|
|
|
|
|
|
factory OathState.fromJson(Map<String, dynamic> json) =>
|
|
|
|
_$OathStateFromJson(json);
|
|
|
|
}
|
|
|
|
|
|
|
|
@freezed
|
|
|
|
class CredentialData with _$CredentialData {
|
|
|
|
const CredentialData._();
|
|
|
|
|
|
|
|
factory CredentialData({
|
|
|
|
String? issuer,
|
|
|
|
required String name,
|
|
|
|
required String secret,
|
2022-01-28 19:05:05 +03:00
|
|
|
@Default(defaultOathType) OathType oathType,
|
|
|
|
@Default(defaultHashAlgorithm) HashAlgorithm hashAlgorithm,
|
|
|
|
@Default(defaultDigits) int digits,
|
|
|
|
@Default(defaultPeriod) int period,
|
|
|
|
@Default(defaultCounter) int counter,
|
2021-11-19 17:05:57 +03:00
|
|
|
}) = _CredentialData;
|
|
|
|
|
|
|
|
factory CredentialData.fromJson(Map<String, dynamic> json) =>
|
|
|
|
_$CredentialDataFromJson(json);
|
|
|
|
|
2023-08-08 17:21:56 +03:00
|
|
|
static List<CredentialData> fromUri(Uri uri) {
|
|
|
|
if (uri.scheme.toLowerCase() == 'otpauth-migration') {
|
|
|
|
return CredentialData.fromMigration(uri);
|
|
|
|
} else if (uri.scheme.toLowerCase() == 'otpauth') {
|
|
|
|
return [CredentialData.fromOtpauth(uri)];
|
|
|
|
} else {
|
|
|
|
throw ArgumentError('Invalid scheme');
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-08-11 09:55:38 +03:00
|
|
|
static List<CredentialData> fromMigration(Uri uri) {
|
|
|
|
// Parse a single protobuf value from a buffer
|
|
|
|
(int tag, dynamic value, Uint8List rem) protoValue(Uint8List data) {
|
|
|
|
final first = data[0];
|
|
|
|
final index = first >> 3;
|
|
|
|
final second = data[1];
|
|
|
|
data = data.sublist(2);
|
|
|
|
switch (first & 0x07) {
|
|
|
|
case 0:
|
|
|
|
assert(second & 0x80 == 0);
|
|
|
|
return (index, second, data);
|
|
|
|
case 2:
|
|
|
|
assert(second & 0x80 == 0);
|
|
|
|
return (index, data.sublist(0, second), data.sublist(second));
|
2023-06-13 14:48:41 +03:00
|
|
|
}
|
2023-08-11 09:55:38 +03:00
|
|
|
throw ArgumentError('Unsupported value type!');
|
|
|
|
}
|
2023-05-12 12:38:56 +03:00
|
|
|
|
2023-08-11 09:55:38 +03:00
|
|
|
// Parse a protobuf message into map of tags and values
|
|
|
|
Map<int, dynamic> protoMap(Uint8List data) {
|
|
|
|
Map<int, dynamic> values = {};
|
|
|
|
while (data.isNotEmpty) {
|
|
|
|
final (tag, value, rem) = protoValue(data);
|
|
|
|
values[tag] = value;
|
|
|
|
data = rem;
|
2023-05-12 12:38:56 +03:00
|
|
|
}
|
2023-08-11 09:55:38 +03:00
|
|
|
return values;
|
|
|
|
}
|
2023-05-12 12:38:56 +03:00
|
|
|
|
2023-08-11 09:55:38 +03:00
|
|
|
// Parse encoded credentials from data (tag 1) ignoring trailing extra data
|
|
|
|
Iterable<Map<int, dynamic>> splitCreds(Uint8List rem) sync* {
|
|
|
|
Uint8List credrem;
|
|
|
|
while (rem[0] == 0x0a) {
|
|
|
|
(_, credrem, rem) = protoValue(rem);
|
|
|
|
yield protoMap(credrem);
|
2023-06-13 14:48:41 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-08-11 09:55:38 +03:00
|
|
|
// Convert parsed credential values into CredentialData objects
|
|
|
|
return splitCreds(base64.decode(uri.queryParameters['data']!))
|
|
|
|
.map((values) => CredentialData(
|
|
|
|
secret: base32.encode(values[1]),
|
|
|
|
name: utf8.decode(values[2], allowMalformed: true),
|
|
|
|
issuer: values[3] != null
|
|
|
|
? utf8.decode(values[3], allowMalformed: true)
|
|
|
|
: null,
|
|
|
|
hashAlgorithm: switch (values[4]) {
|
|
|
|
2 => HashAlgorithm.sha256,
|
|
|
|
3 => HashAlgorithm.sha512,
|
|
|
|
_ => HashAlgorithm.sha1,
|
|
|
|
},
|
|
|
|
digits: values[5] == 2 ? 8 : defaultDigits,
|
|
|
|
oathType: values[6] == 1 ? OathType.hotp : OathType.totp,
|
|
|
|
counter: values[7] ?? defaultCounter,
|
|
|
|
))
|
|
|
|
.toList();
|
2023-06-13 14:48:41 +03:00
|
|
|
}
|
|
|
|
|
2023-08-08 17:21:56 +03:00
|
|
|
factory CredentialData.fromOtpauth(Uri uri) {
|
2022-02-11 16:56:35 +03:00
|
|
|
final oathType = OathType.values.byName(uri.host.toLowerCase());
|
|
|
|
final params = uri.queryParameters;
|
|
|
|
String? issuer;
|
|
|
|
String name = uri.pathSegments.join('/');
|
|
|
|
final nameIndex = name.indexOf(':');
|
|
|
|
if (nameIndex >= 0) {
|
|
|
|
issuer = name.substring(0, nameIndex);
|
|
|
|
name = name.substring(nameIndex + 1);
|
|
|
|
}
|
|
|
|
return CredentialData(
|
|
|
|
issuer: params['issuer'] ?? issuer,
|
|
|
|
name: name,
|
|
|
|
oathType: oathType,
|
2022-02-21 14:38:13 +03:00
|
|
|
hashAlgorithm: HashAlgorithm.values
|
|
|
|
.byName(params['algorithm']?.toLowerCase() ?? 'sha1'),
|
2022-02-11 16:56:35 +03:00
|
|
|
secret: params['secret']!,
|
|
|
|
digits: int.tryParse(params['digits'] ?? '') ?? defaultDigits,
|
|
|
|
period: int.tryParse(params['period'] ?? '') ?? defaultPeriod,
|
|
|
|
counter: int.tryParse(params['counter'] ?? '') ?? defaultCounter,
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2022-07-06 11:12:30 +03:00
|
|
|
Uri toUri() => Uri(
|
|
|
|
scheme: 'otpauth',
|
|
|
|
host: oathType.name,
|
|
|
|
path: issuer != null ? '$issuer:$name' : name,
|
|
|
|
queryParameters: {
|
|
|
|
'secret': secret,
|
|
|
|
if (oathType == OathType.totp) 'period': period.toString(),
|
|
|
|
if (oathType == OathType.hotp) 'counter': counter.toString(),
|
|
|
|
if (issuer != null) 'issuer': issuer!,
|
|
|
|
if (digits != 6) 'digits': digits.toString(),
|
|
|
|
if (hashAlgorithm != HashAlgorithm.sha1)
|
|
|
|
'algorithm': hashAlgorithm.name,
|
|
|
|
},
|
|
|
|
);
|
2021-11-19 17:05:57 +03:00
|
|
|
}
|