|
| 1 | +import 'dart:math'; |
| 2 | + |
| 3 | +import 'package:convert/convert.dart'; |
| 4 | +import 'package:flutter/foundation.dart'; |
| 5 | + |
| 6 | +/// The authentication information contained in the zulip:// redirect URL. |
| 7 | +class WebAuthPayload { |
| 8 | + final String otpEncryptedApiKey; |
| 9 | + final String email; |
| 10 | + final int? userId; // TODO(server-5) new in FL 108 |
| 11 | + final Uri realm; |
| 12 | + |
| 13 | + WebAuthPayload._({ |
| 14 | + required this.otpEncryptedApiKey, |
| 15 | + required this.email, |
| 16 | + required this.userId, |
| 17 | + required this.realm, |
| 18 | + }); |
| 19 | + |
| 20 | + factory WebAuthPayload.parse(Uri url) { |
| 21 | + if ( |
| 22 | + url case Uri( |
| 23 | + scheme: 'zulip', |
| 24 | + host: 'login', |
| 25 | + queryParameters: { |
| 26 | + 'realm': String realmStr, |
| 27 | + 'email': String email, |
| 28 | + // 'user_id' handled below |
| 29 | + 'otp_encrypted_api_key': String otpEncryptedApiKey, |
| 30 | + }, |
| 31 | + ) |
| 32 | + ) { |
| 33 | + // TODO(server-5) require in queryParameters (new in FL 108) |
| 34 | + final userIdStr = url.queryParameters['user_id']; |
| 35 | + int? userId; |
| 36 | + if (userIdStr != null) { |
| 37 | + userId = int.tryParse(userIdStr, radix: 10); |
| 38 | + if (userId == null) throw const FormatException(); |
| 39 | + } |
| 40 | + |
| 41 | + final Uri? realm = Uri.tryParse(realmStr); |
| 42 | + if (realm == null) throw const FormatException(); |
| 43 | + |
| 44 | + if (!RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(otpEncryptedApiKey)) { |
| 45 | + throw const FormatException(); |
| 46 | + } |
| 47 | + |
| 48 | + return WebAuthPayload._( |
| 49 | + otpEncryptedApiKey: otpEncryptedApiKey, |
| 50 | + email: email, |
| 51 | + userId: userId, |
| 52 | + realm: realm, |
| 53 | + ); |
| 54 | + } else { |
| 55 | + // TODO(dart): simplify after https://github.com/dart-lang/language/issues/2537 |
| 56 | + throw const FormatException(); |
| 57 | + } |
| 58 | + } |
| 59 | + |
| 60 | + String decodeApiKey(String otp) { |
| 61 | + final otpBytes = hex.decode(otp); |
| 62 | + final otpEncryptedApiKeyBytes = hex.decode(otpEncryptedApiKey); |
| 63 | + if (otpBytes.length != otpEncryptedApiKeyBytes.length) { |
| 64 | + throw const FormatException(); |
| 65 | + } |
| 66 | + return String.fromCharCodes(Iterable.generate(otpBytes.length, |
| 67 | + (i) => otpBytes[i] ^ otpEncryptedApiKeyBytes[i])); |
| 68 | + } |
| 69 | +} |
| 70 | + |
| 71 | +String generateOtp() { |
| 72 | + final rand = Random.secure(); |
| 73 | + final Uint8List bytes = Uint8List.fromList( |
| 74 | + List.generate(32, (_) => rand.nextInt(256))); |
| 75 | + return hex.encode(bytes); |
| 76 | +} |
| 77 | + |
| 78 | +/// For tests, create an OTP-encrypted API key. |
| 79 | +@visibleForTesting |
| 80 | +String debugEncodeApiKey(String apiKey, String otp) { |
| 81 | + final apiKeyBytes = apiKey.codeUnits; |
| 82 | + assert(apiKeyBytes.every((byte) => byte <= 0xff)); |
| 83 | + final otpBytes = hex.decode(otp); |
| 84 | + assert(apiKeyBytes.length == otpBytes.length); |
| 85 | + return hex.encode(List.generate(otpBytes.length, |
| 86 | + (i) => apiKeyBytes[i] ^ otpBytes[i])); |
| 87 | +} |
0 commit comments