mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(auth): harden tht auth mutations

Browse Source
This commit is contained in:
marcopan
2026-08-16 19:37:12 +02:00
parent 9646ae09a0
commit 856ac05edc
6 changed files with 245 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tht/internal/authconfig/commands.go
+36 -20
View File
@@ -26,6 +26,9 @@ const maxPasswordFileBytes int64 = 1025
var errCommandRefused = errors.New("authentication command refused")
var writeNewAuthFile = safeio.WriteCanonicalNewFile
var removeAuthFile = safeio.RemoveCanonicalPrivateRegular
// Run implements the host-only authentication operator surface. It accepts password bytes only
// from an echo-free terminal or a bounded private file, and never writes them to either stream.
func Run(ctx context.Context, installation config.Installation, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
@@ -105,10 +108,8 @@ func configure(directory string, args []string, stdin io.Reader, stderr io.Write
if _, _, err := Load(directory); err == nil {
return errExistingConfiguration
}
for _, name := range []string{authFileName, usersFileName} {
if _, err := os.Lstat(filepath.Join(directory, name)); !errors.Is(err, os.ErrNotExist) {
return errCommandRefused
}
if err := recoverOrRefuseBootstrapState(directory); err != nil {
return err
}
if request.mode == "oidc" {
if request.userGroup == request.adminGroup {
@@ -145,20 +146,22 @@ func parseConfigure(args []string) (configureRequest, error) {
"--issuer": &request.issuer, "--client-id": &request.clientID, "--authentik-base-url": &request.authentikBaseURL,
"--user-group": &request.userGroup, "--admin-group": &request.adminGroup,
}
seen := make(map[string]bool, len(values))
for len(args) > 0 {
option := args[0]
args = args[1:]
target, exists := values[option]
if !exists || len(args) == 0 || *target != "" {
if !exists || seen[option] || len(args) == 0 || args[0] == "" {
return configureRequest{}, errCommandRefused
}
*target, args = args[0], args[1:]
seen[option] = true
}
if request.mode != "local" && request.mode != "oidc" || !validPublicURL(request.publicURL) {
return configureRequest{}, errCommandRefused
}
if request.mode == "local" {
if request.issuer != "" || request.clientID != "" || request.authentikBaseURL != "" || request.userGroup != "" || request.adminGroup != "" {
if seen["--issuer"] || seen["--client-id"] || seen["--authentik-base-url"] || seen["--user-group"] || seen["--admin-group"] {
return configureRequest{}, errCommandRefused
}
if request.adminUser != "" && request.passwordFile == "" { // TTY supplies the password interactively.
@@ -166,7 +169,7 @@ func parseConfigure(args []string) (configureRequest, error) {
}
return request, nil
}
if request.adminUser != "" || request.adminDisplayName != "" || request.passwordFile != "" || request.issuer == "" || request.clientID == "" || request.authentikBaseURL == "" || request.userGroup == "" || request.adminGroup == "" || !validOIDCURL(request.issuer) || !validHTTPSURL(request.authentikBaseURL) || (!isHTTPS(request.publicURL) && !isLoopbackURL(request.publicURL)) {
if seen["--admin-user"] || seen["--admin-display-name"] || seen["--password-file"] || request.issuer == "" || request.clientID == "" || request.authentikBaseURL == "" || request.userGroup == "" || request.adminGroup == "" || !validOIDCURL(request.issuer) || !validHTTPSURL(request.authentikBaseURL) || (!isHTTPS(request.publicURL) && !isLoopbackURL(request.publicURL)) {
return configureRequest{}, errCommandRefused
}
return request, nil
@@ -208,10 +211,13 @@ func writeInitialLocal(directory, publicURL string, user User) error {
if err != nil {
return errCommandRefused
}
if err := safeio.WriteCanonicalNewFile(filepath.Join(directory, usersFileName), append(registryBytes, '\n'), 0o600); err != nil {
if err := writeNewAuthFile(filepath.Join(directory, usersFileName), append(registryBytes, '\n'), 0o600); err != nil {
return errCommandRefused
}
if err := safeio.WriteCanonicalNewFile(filepath.Join(directory, authFileName), append(configBytes, '\n'), 0o600); err != nil {
if err := writeNewAuthFile(filepath.Join(directory, authFileName), append(configBytes, '\n'), 0o600); err != nil {
if removeErr := removeAuthFile(filepath.Join(directory, usersFileName)); removeErr != nil {
return errCommandRefused
}
return errCommandRefused
}
return nil
@@ -228,7 +234,7 @@ func writeInitialOIDC(directory string, request configureRequest) error {
if err != nil {
return errCommandRefused
}
if err := safeio.WriteCanonicalNewFile(filepath.Join(directory, authFileName), append(contents, '\n'), 0o600); err != nil {
if err := writeNewAuthFile(filepath.Join(directory, authFileName), append(contents, '\n'), 0o600); err != nil {
return errCommandRefused
}
return nil
@@ -442,33 +448,26 @@ func parseUserRolePassword(args []string) (string, userRequest, error) {
username := args[0]
args = args[1:]
request := userRequest{}
seen := make(map[string]bool, 3)
for len(args) > 0 {
option := args[0]
args = args[1:]
if len(args) == 0 {
if len(args) == 0 || args[0] == "" || seen[option] {
return "", userRequest{}, errCommandRefused
}
value := args[0]
args = args[1:]
switch option {
case "--role":
if request.role != "" {
return "", userRequest{}, errCommandRefused
}
request.role = Role(value)
case "--display-name":
if request.displayName != "" {
return "", userRequest{}, errCommandRefused
}
request.displayName = value
case "--password-file":
if request.passwordFile != "" {
return "", userRequest{}, errCommandRefused
}
request.passwordFile = value
default:
return "", userRequest{}, errCommandRefused
}
seen[option] = true
}
if !usernamePattern.MatchString(username) || (request.role != RoleUser && request.role != RoleAdmin) {
return "", userRequest{}, errCommandRefused
@@ -514,6 +513,23 @@ func parsePasswordFile(args []string) (string, error) {
return args[1], nil
}
func recoverOrRefuseBootstrapState(directory string) error {
authPath := filepath.Join(directory, authFileName)
usersPath := filepath.Join(directory, usersFileName)
_, authErr := os.Lstat(authPath)
_, usersErr := os.Lstat(usersPath)
if !errors.Is(authErr, os.ErrNotExist) {
return errCommandRefused
}
if errors.Is(usersErr, os.ErrNotExist) {
return nil
}
if usersErr != nil || removeAuthFile(usersPath) != nil {
return errCommandRefused
}
return nil
}
func setEnabled(directory string, enabled bool, args []string) error {
if len(args) != 1 || !usernamePattern.MatchString(args[0]) {
return errCommandRefused