chore: sync project files

server/api_key.go

@@ -0,0 +1,74 @@
+/******************************************************************************
+ *
+ *  Description :
+ *
+ *  Authentication
+ *
+ *****************************************************************************/
+
+package main
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/md5"
+	"encoding/base64"
+
+	"github.com/tinode/chat/server/logs"
+)
+
+// Singned AppID. Composition:
+//
+//	[1:algorithm version][4:appid][2:key sequence][1:isRoot][16:signature] = 24 bytes
+//
+// convertible to base64 without padding. All integers are little-endian.
+// Definitions for byte lengths of key's parts.
+const (
+	// apikeyVersion is the version of this API scheme.
+	apikeyVersion = 1
+	// apikeyAppID is deprecated and will be removed in the future.
+	apikeyAppID = 4
+	// apikeySequence is the serial number of the key.
+	apikeySequence = 2
+	// apikeyWho indicates if the key grants root privileges.
+	apikeyWho = 1
+	// apikeySignature is key's cryptographic (HMAC) signature.
+	apikeySignature = 16
+	// apikeyLength is the length of the key in bytes.
+	apikeyLength = apikeyVersion + apikeyAppID + apikeySequence + apikeyWho + apikeySignature
+)
+
+// Client signature validation
+//
+//	key: client's secret key
+//
+// Returns application id, key type.
+func checkAPIKey(apikey string) (isValid, isRoot bool) {
+	if declen := base64.URLEncoding.DecodedLen(len(apikey)); declen != apikeyLength {
+		return
+	}
+
+	data, err := base64.URLEncoding.DecodeString(apikey)
+	if err != nil {
+		logs.Warn.Println("failed to decode.base64 appid ", err)
+		return
+	}
+	if data[0] != 1 {
+		logs.Warn.Println("unknown appid signature algorithm ", data[0])
+		return
+	}
+
+	hasher := hmac.New(md5.New, globals.apiKeySalt)
+	hasher.Write(data[:apikeyVersion+apikeyAppID+apikeySequence+apikeyWho])
+	check := hasher.Sum(nil)
+	if !bytes.Equal(data[apikeyVersion+apikeyAppID+apikeySequence+apikeyWho:], check) {
+		logs.Warn.Println("invalid apikey signature")
+		return
+	}
+
+	isRoot = (data[apikeyVersion+apikeyAppID+apikeySequence] == 1)
+
+	isValid = true
+
+	return
+}