openteam/server/internal/passkey/passkey.go

// Package passkey 封装 WebAuthn（passkey）注册与登录。
// 依赖 go-webauthn 库；RPID/RPOrigin 由配置提供。
package passkey

import (
	"bytes"
	"encoding/json"
	"errors"
	"net/http"
	"net/http/httptest"
	"strconv"
	"sync"
	"time"

	"github.com/go-webauthn/webauthn/protocol"
	"github.com/go-webauthn/webauthn/webauthn"
	"github.com/openteam/server/internal/store"
	"gorm.io/gorm"
)

type Config struct {
	RPID   string
	Origin string
	Name   string
}

// Service WebAuthn 服务：凭据存储 + challenge 会话（内存）。
type Service struct {
	wa *webauthn.WebAuthn
	db *gorm.DB

	mu       sync.Mutex
	sessions map[string]webauthn.SessionData // keyed by challenge
}

// maxSessions challenge 会话上限：login/begin 无需认证，不设上限的话每次调用
// 都会向 map 永久写入一条（只有完成认证才删），持续打可把进程内存打爆。
const maxSessions = 4096

func New(db *gorm.DB, cfg Config) (*Service, error) {
	wa, err := webauthn.New(&webauthn.Config{
		RPDisplayName: cfg.Name,
		RPID:          cfg.RPID,
		RPOrigins:     []string{cfg.Origin},
		Timeouts: webauthn.TimeoutsConfig{
			Login:        webauthn.TimeoutConfig{Enforce: true, Timeout: 5 * time.Minute, TimeoutUVD: 5 * time.Minute},
			Registration: webauthn.TimeoutConfig{Enforce: true, Timeout: 5 * time.Minute, TimeoutUVD: 5 * time.Minute},
		},
	})
	if err != nil {
		return nil, err
	}
	return &Service{wa: wa, db: db, sessions: map[string]webauthn.SessionData{}}, nil
}

// webUser 实现 go-webauthn 的 User 接口。
type webUser struct {
	id          uint64
	name        string
	displayName string
	credentials []webauthn.Credential
}

func (u *webUser) WebAuthnID() []byte                { return []byte(strconv.FormatUint(u.id, 10)) }
func (u *webUser) WebAuthnName() string              { return u.name }
func (u *webUser) WebAuthnDisplayName() string       { return u.displayName }
func (u *webUser) WebAuthnIcon() string              { return "" }
func (u *webUser) WebAuthnCredentials() []webauthn.Credential { return u.credentials }

func (s *Service) loadWebUser(u *store.User) (*webUser, error) {
	var pks []store.Passkey
	s.db.Where("user_id = ?", u.ID).Find(&pks)
	creds := make([]webauthn.Credential, 0, len(pks))
	for _, pk := range pks {
		var c webauthn.Credential
		if err := json.Unmarshal(pk.Credential, &c); err == nil {
			creds = append(creds, c)
		}
	}
	return &webUser{id: u.ID, name: u.Username, displayName: u.Username, credentials: creds}, nil
}

// ---------------------------------------------------------------------------
// 注册

// BeginRegistration 生成注册选项并暂存 challenge。
func (s *Service) BeginRegistration(u *store.User) (*protocol.CredentialCreation, error) {
	wu, err := s.loadWebUser(u)
	if err != nil {
		return nil, err
	}
	creation, session, err := s.wa.BeginRegistration(wu)
	if err != nil {
		return nil, err
	}
	s.storeSession(session)
	return creation, nil
}

// FinishRegistration 校验浏览器返回的凭据并落库。
func (s *Service) FinishRegistration(u *store.User, challenge string, body, name []byte) error {
	session, ok := s.takeSession(challenge)
	if !ok {
		return errors.New("challenge 已过期或不存在")
	}
	wu, err := s.loadWebUser(u)
	if err != nil {
		return err
	}
	req := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(body))
	cred, err := s.wa.FinishRegistration(wu, session, req)
	if err != nil {
		return err
	}
	raw, _ := json.Marshal(cred)
	nm := string(name)
	if nm == "" {
		nm = "passkey"
	}
	return s.db.Create(&store.Passkey{
		UserID: u.ID, Name: nm, CredentialID: cred.ID, Credential: raw,
	}).Error
}

// ---------------------------------------------------------------------------
// 登录

// BeginLogin 已知用户（按用户名）发起断言。
func (s *Service) BeginLogin(u *store.User) (*protocol.CredentialAssertion, error) {
	wu, err := s.loadWebUser(u)
	if err != nil {
		return nil, err
	}
	assertion, session, err := s.wa.BeginLogin(wu)
	if err != nil {
		return nil, err
	}
	s.storeSession(session)
	return assertion, nil
}

// BeginDiscoverableLogin 无用户名（使用平台/漫游器上的可发现凭据）。
func (s *Service) BeginDiscoverableLogin() (*protocol.CredentialAssertion, error) {
	assertion, session, err := s.wa.BeginDiscoverableLogin()
	if err != nil {
		return nil, err
	}
	s.storeSession(session)
	return assertion, nil
}

// FinishLogin 校验断言并更新签名计数。
func (s *Service) FinishLogin(u *store.User, challenge string, body []byte) error {
	session, ok := s.takeSession(challenge)
	if !ok {
		return errors.New("challenge 已过期或不存在")
	}
	wu, err := s.loadWebUser(u)
	if err != nil {
		return err
	}
	req := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(body))
	cred, err := s.wa.FinishLogin(wu, session, req)
	if err != nil {
		return err
	}
	return s.updateCredential(u.ID, cred)
}

// FinishDiscoverableLogin 通过凭据定位用户并校验断言。
func (s *Service) FinishDiscoverableLogin(challenge string, body []byte) (*store.User, error) {
	session, ok := s.takeSession(challenge)
	if !ok {
		return nil, errors.New("challenge 已过期或不存在")
	}
	req := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(body))
	handler := func(rawID, userHandle []byte) (webauthn.User, error) {
		var pk store.Passkey
		if err := s.db.Where("credential_id = ?", rawID).First(&pk).Error; err != nil {
			return nil, errors.New("credential not found")
		}
		var u store.User
		if err := s.db.First(&u, pk.UserID).Error; err != nil {
			return nil, errors.New("user not found")
		}
		return s.loadWebUser(&u)
	}
	user, cred, err := s.wa.FinishPasskeyLogin(handler, session, req)
	if err != nil {
		return nil, err
	}
	wu := user.(*webUser)
	_ = s.updateCredential(wu.id, cred)
	var st store.User
	if err := s.db.First(&st, wu.id).Error; err != nil {
		return nil, err
	}
	return &st, nil
}

// ---------------------------------------------------------------------------
// 管理

// List 列出用户的 passkey。
func (s *Service) List(userID uint64) ([]store.Passkey, error) {
	var pks []store.Passkey
	err := s.db.Where("user_id = ?", userID).Order("id DESC").Find(&pks).Error
	return pks, err
}

// Delete 删除用户的 passkey。
func (s *Service) Delete(userID, id uint64) error {
	res := s.db.Where("id = ? AND user_id = ?", id, userID).Delete(&store.Passkey{})
	if res.Error != nil {
		return res.Error
	}
	if res.RowsAffected == 0 {
		return gorm.ErrRecordNotFound
	}
	return nil
}

func (s *Service) updateCredential(userID uint64, cred *webauthn.Credential) error {
	raw, _ := json.Marshal(cred)
	return s.db.Model(&store.Passkey{}).
		Where("user_id = ? AND credential_id = ?", userID, cred.ID).
		Update("credential", raw).Error
}

// ---------------------------------------------------------------------------
// challenge 会话

func (s *Service) storeSession(session *webauthn.SessionData) {
	s.mu.Lock()
	defer s.mu.Unlock()
	// 到容量上限先清一轮已过期会话；仍满则淘汰最早过期的（未过期说明正在被
	// 正常使用，丢最不紧迫的）。配合 Enforce 过期校验，map 大小有硬上界。
	if len(s.sessions) >= maxSessions {
		now := time.Now()
		var oldestKey string
		var oldestExp time.Time
		for k, v := range s.sessions {
			if now.After(v.Expires) {
				delete(s.sessions, k)
				continue
			}
			if oldestKey == "" || v.Expires.Before(oldestExp) {
				oldestKey, oldestExp = k, v.Expires
			}
		}
		if len(s.sessions) >= maxSessions && oldestKey != "" {
			delete(s.sessions, oldestKey)
		}
	}
	s.sessions[session.Challenge] = *session
}

func (s *Service) takeSession(challenge string) (webauthn.SessionData, bool) {
	s.mu.Lock()
	sess, ok := s.sessions[challenge]
	if ok {
		delete(s.sessions, challenge)
	}
	s.mu.Unlock()
	// Expires 可能为零值：go-webauthn 默认 Enforce=false 不设过期时间。
	// 零值时间恒早于 now，直接 After 会把每个 challenge 都判为过期，
	// 与库内部一致，仅当显式设置了过期时间才做校验。
	if ok && !sess.Expires.IsZero() && time.Now().After(sess.Expires) {
		return webauthn.SessionData{}, false
	}
	return sess, ok
}