Node / ReticulumProjects / MeshChatX.git / files / meshchatx / src / backend / altcha_auth.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

T8b949e"""ALTCHA proof-of-work verification for login and setup."""

Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations

Tff7b72import T7ee787os

Tff7b72import T7ee787time

Tff7b72from T7ee787typing Tff7b72import Te6edf3Any

Tff7b72import T7ee787altcha

Tff7b72from T7ee787aiohttp Tff7b72import Te6edf3web

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787env_utils Tff7b72import Te6edf3env_bool

Te6edf3ALTCHA_INVALID_CODE Tff7b72= Ta5d6ff"Ta5d6ffaltcha_invalidTa5d6ff"

Te6edf3ALTCHA_ALGORITHM Tff7b72= Ta5d6ff"Ta5d6ffPBKDF2/SHA-256Ta5d6ff"

Te6edf3ALTCHA_DEFAULT_COST Tff7b72= T79c0ff2000

Tff7b72def Td2a8ffaltcha_enabled_from_envTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:

Tff7b72return Te6edf3env_boolTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_ALTCHA_ENABLEDTa5d6ff"Tb4b4b4, Tff7b72FalseTb4b4b4)

Tff7b72def Td2a8ffaltcha_hmac_secretTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657str Tff7b72| Tff7b72NoneTb4b4b4:

Te6edf3raw Tff7b72= Te6edf3osTff7b72.Td2a8ffenvironTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_ALTCHA_HMAC_KEYTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff"Tb4b4b4)Tff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)

Tff7b72return Te6edf3raw Tff7b72or Tff7b72None

Tff7b72def Td2a8ffaltcha_configuredTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:

Tff7b72return Te6edf3altcha_enabled_from_envTb4b4b4(Tb4b4b4) Tff7b72and Tffa657boolTb4b4b4(Te6edf3altcha_hmac_secretTb4b4b4(Tb4b4b4)Tb4b4b4)

Tff7b72def Td2a8ffaltcha_pow_costTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:

Te6edf3raw Tff7b72= Te6edf3osTff7b72.Td2a8ffenvironTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_ALTCHA_COSTTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff"Tb4b4b4)Tff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)

Tff7b72if Tff7b72not Te6edf3rawTb4b4b4:

Tff7b72return Te6edf3ALTCHA_DEFAULT_COST

Tff7b72tryTb4b4b4:

Tff7b72return Tffa657maxTb4b4b4(T79c0ff100Tb4b4b4, Tffa657intTb4b4b4(Te6edf3rawTb4b4b4)Tb4b4b4)

Tff7b72except Tf85149ValueErrorTb4b4b4:

Tff7b72return Te6edf3ALTCHA_DEFAULT_COST

Tff7b72def Td2a8ffcreate_altcha_challenge_dictTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Te6edf3AnyTb4b4b4]Tb4b4b4:

Te6edf3secret Tff7b72= Te6edf3altcha_hmac_secretTb4b4b4(Tb4b4b4)

Tff7b72if Tff7b72not Te6edf3secretTb4b4b4:

Te6edf3msg Tff7b72= Ta5d6ff"Ta5d6ffMESHCHAT_ALTCHA_HMAC_KEY is required when ALTCHA is enabledTa5d6ff"

Tff7b72raise Tf85149RuntimeErrorTb4b4b4(Te6edf3msgTb4b4b4)

Te6edf3expires_at Tff7b72= Tffa657intTb4b4b4(Te6edf3timeTff7b72.Td2a8fftimeTb4b4b4(Tb4b4b4)Tb4b4b4) Tff7b72+ T79c0ff300

Te6edf3challenge Tff7b72= Te6edf3altchaTff7b72.Td2a8ffcreate_challengeTb4b4b4(

Te6edf3ALTCHA_ALGORITHMTb4b4b4,

Te6edf3altcha_pow_costTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3hmac_secretTff7b72=Te6edf3secretTb4b4b4,

Te6edf3expires_atTff7b72=Te6edf3expires_atTb4b4b4,

Tb4b4b4)

Tff7b72return Te6edf3challengeTff7b72.Td2a8ffto_dictTb4b4b4(Tb4b4b4)

Tff7b72def Td2a8ffverify_altcha_submissionTb4b4b4(Te6edf3payloadTb4b4b4: Te6edf3AnyTb4b4b4) Tff7b72-Tff7b72> Tffa657tupleTb4b4b4[Tffa657boolTb4b4b4, Tffa657str Tff7b72| Tff7b72NoneTb4b4b4]Tb4b4b4:

Te6edf3secret Tff7b72= Te6edf3altcha_hmac_secretTb4b4b4(Tb4b4b4)

Tff7b72if Tff7b72not Te6edf3secretTb4b4b4:

Tff7b72return Tff7b72FalseTb4b4b4, Ta5d6ff"Ta5d6ffaltcha_not_configuredTa5d6ff"

Tff7b72if Te6edf3payload Tff7b72is Tff7b72NoneTb4b4b4:

Tff7b72return Tff7b72FalseTb4b4b4, Te6edf3ALTCHA_INVALID_CODE

Tff7b72if Tffa657isinstanceTb4b4b4(Te6edf3payloadTb4b4b4, Tffa657dictTb4b4b4)Tb4b4b4:

Tff7b72import T7ee787json

Te6edf3payload Tff7b72= Te6edf3jsonTff7b72.Td2a8ffdumpsTb4b4b4(Te6edf3payloadTb4b4b4)

Tff7b72if Tff7b72not Tffa657isinstanceTb4b4b4(Te6edf3payloadTb4b4b4, Tffa657strTb4b4b4) Tff7b72or Tff7b72not Te6edf3payloadTff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72return Tff7b72FalseTb4b4b4, Te6edf3ALTCHA_INVALID_CODE

Tff7b72tryTb4b4b4:

Te6edf3result Tff7b72= Te6edf3altchaTff7b72.Td2a8ffverify_solutionTb4b4b4(Te6edf3payloadTff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)Tb4b4b4, Te6edf3secretTb4b4b4)

Tff7b72except Tf85149ExceptionTb4b4b4:

Tff7b72return Tff7b72FalseTb4b4b4, Te6edf3ALTCHA_INVALID_CODE

Tff7b72if Tff7b72not Te6edf3resultTff7b72.Td2a8ffverifiedTb4b4b4:

Te6edf3err Tff7b72= Te6edf3resultTff7b72.Td2a8fferror Tff7b72or Te6edf3ALTCHA_INVALID_CODE

Tff7b72return Tff7b72FalseTb4b4b4, Te6edf3err

Tff7b72return Tff7b72TrueTb4b4b4, Tff7b72None

Tff7b72def Td2a8ffaltcha_error_responseTb4b4b4(Te6edf3codeTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Te6edf3webTff7b72.Td2a8ffResponseTb4b4b4:

Tff7b72return Te6edf3webTff7b72.Td2a8ffjson_responseTb4b4b4(

Tb4b4b4{Ta5d6ff"Ta5d6fferrorTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffALTCHA verification failedTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffcodeTa5d6ff"Tb4b4b4: Te6edf3codeTb4b4b4}Tb4b4b4,

Te6edf3statusTff7b72=T79c0ff400Tb4b4b4,

Tb4b4b4)

Tff7b72async Tff7b72def Td2a8ffrequire_altcha_payloadTb4b4b4(Te6edf3requestTb4b4b4, Te6edf3dataTb4b4b4: Tffa657dictTb4b4b4) Tff7b72-Tff7b72> Te6edf3webTff7b72.Td2a8ffResponse Tff7b72| Tff7b72NoneTb4b4b4:

Tff7b72if Tff7b72not Te6edf3altcha_enabled_from_envTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72return Tff7b72None

Te6edf3payload Tff7b72= Te6edf3dataTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffaltchaTa5d6ff"Tb4b4b4)

Te6edf3okTb4b4b4, Te6edf3code Tff7b72= Te6edf3verify_altcha_submissionTb4b4b4(Te6edf3payloadTb4b4b4)

Tff7b72if Tff7b72not Te6edf3okTb4b4b4:

Tff7b72return Te6edf3altcha_error_responseTb4b4b4(Te6edf3code Tff7b72or Te6edf3ALTCHA_INVALID_CODETb4b4b4)

Tff7b72return Tff7b72None