108 lines
6.1 KiB
PHP
108 lines
6.1 KiB
PHP
<?php
|
|
namespace BluditSecure;
|
|
|
|
/** One locked transaction for reads/updates; PHP-protected encrypted file, outside uploads. */
|
|
final class Store
|
|
{
|
|
private string $dir;
|
|
public function __construct(string $dir) {
|
|
$this->dir = $dir;
|
|
if (!is_dir($dir) && !mkdir($dir, 0700, true)) { throw new \RuntimeException('Storage unavailable'); }
|
|
}
|
|
public function transaction(callable $fn): mixed {
|
|
$lock = fopen($this->dir.'/secure.lock.php', 'c+');
|
|
if (!$lock) { throw new \RuntimeException('Storage locked'); }
|
|
if (!flock($lock, LOCK_EX)) { fclose($lock); throw new \RuntimeException('Storage locked'); }
|
|
$key = null;
|
|
try {
|
|
chmod($this->dir.'/secure.lock.php', 0600);
|
|
$kp = $this->dir.'/secure.key.php';
|
|
$path = $this->dir.'/secure.data.php';
|
|
$prefix = "<?php exit; ?>\n";
|
|
if (!file_exists($kp)) {
|
|
if (file_exists($path)) { throw new \RuntimeException('Missing encryption key'); }
|
|
$initialKey = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES);
|
|
try {
|
|
$this->write($kp, $prefix.base64_encode($initialKey));
|
|
$nonce = random_bytes(24);
|
|
$this->write($path, $prefix.base64_encode($nonce.sodium_crypto_secretbox('{"accounts":[],"limits":[]}', $nonce, $initialKey)));
|
|
} finally { sodium_memzero($initialKey); }
|
|
}
|
|
if (!file_exists($path)) { throw new \RuntimeException('Missing security data'); }
|
|
$keyFile = file_get_contents($kp);
|
|
if ($keyFile === false || !str_starts_with($keyFile, $prefix)) { throw new \RuntimeException('Invalid encryption key header'); }
|
|
$key = base64_decode(substr($keyFile, strlen($prefix)), true);
|
|
if ($key === false || strlen($key) !== SODIUM_CRYPTO_SECRETBOX_KEYBYTES) { throw new \RuntimeException('Invalid encryption key'); }
|
|
$data = ['accounts'=>[], 'limits'=>[]];
|
|
if (file_exists($path)) {
|
|
$dataFile = file_get_contents($path);
|
|
if ($dataFile === false || !str_starts_with($dataFile, $prefix)) { throw new \RuntimeException('Invalid storage header'); }
|
|
$raw = base64_decode(substr($dataFile, strlen($prefix)), true);
|
|
if ($raw === false || strlen($raw) < 40) { throw new \RuntimeException('Invalid storage'); }
|
|
$plain = sodium_crypto_secretbox_open(substr($raw, 24), substr($raw, 0, 24), $key);
|
|
if ($plain === false) { throw new \RuntimeException('Storage authentication failed'); }
|
|
$data = json_decode($plain, true, 64, JSON_THROW_ON_ERROR);
|
|
if (!is_array($data) || !isset($data['accounts'], $data['limits']) || !is_array($data['accounts']) || !is_array($data['limits'])) { throw new \RuntimeException('Invalid storage structure'); }
|
|
}
|
|
$before = $data;
|
|
$result = $fn($data);
|
|
if ($data !== $before) {
|
|
$nonce = random_bytes(24);
|
|
$this->write($path, $prefix.base64_encode($nonce.sodium_crypto_secretbox(json_encode($data, JSON_THROW_ON_ERROR), $nonce, $key)));
|
|
}
|
|
return $result;
|
|
} finally {
|
|
if (is_string($key)) { sodium_memzero($key); }
|
|
flock($lock, LOCK_UN); fclose($lock);
|
|
}
|
|
}
|
|
private function write(string $path, string $data): void {
|
|
$tmp = tempnam($this->dir, '.secure-');
|
|
if ($tmp === false) { throw new \RuntimeException('Storage unavailable'); }
|
|
try {
|
|
chmod($tmp, 0600);
|
|
if (file_put_contents($tmp, $data) !== strlen($data) || !rename($tmp, $path)) { throw new \RuntimeException('Storage write failed'); }
|
|
} finally { if (file_exists($tmp)) { unlink($tmp); } }
|
|
}
|
|
public static function account(array $data, string $name): array {
|
|
return $data['accounts'][$name] ?? ['totp'=>null, 'lastStep'=>-1, 'keys'=>[], 'recovery'=>[], 'mode'=>'off', 'sso'=>null, 'ssoProfile'=>null, 'ssoMfa'=>true, 'revision'=>0];
|
|
}
|
|
public function get(string $name): array { return $this->transaction(fn(&$d) => self::account($d, $name)); }
|
|
public function update(string $name, callable $fn): mixed {
|
|
return $this->transaction(function (&$d) use ($name, $fn) {
|
|
$a = self::account($d, $name); $result = $fn($a); $d['accounts'][$name] = $a; return $result;
|
|
});
|
|
}
|
|
/** Reserve before checking credentials so concurrent failures cannot exceed the budget. */
|
|
public function beginAttempt(string $name, string $ip, int $limit = 10): ?array {
|
|
if ($limit < 1) { throw new \InvalidArgumentException('Invalid attempt limit'); }
|
|
return $this->transaction(function (&$d) use ($name, $ip, $limit) {
|
|
$now = time();
|
|
foreach ($d['limits'] as $k=>$v) { if ($v['until'] <= $now) { unset($d['limits'][$k]); } }
|
|
$ids = [hash('sha256', 'account:'.$name), hash('sha256', 'ip:'.$ip)];
|
|
foreach ($ids as $id) { if (($d['limits'][$id]['count'] ?? 0) >= $limit) { return null; } }
|
|
$reservation = [];
|
|
foreach ($ids as $id) {
|
|
$d['limits'][$id] ??= ['count'=>0, 'until'=>$now+300];
|
|
$d['limits'][$id]['window'] ??= bin2hex(random_bytes(8));
|
|
++$d['limits'][$id]['count'];
|
|
$reservation[$id] = $d['limits'][$id]['window'];
|
|
}
|
|
return $reservation;
|
|
});
|
|
}
|
|
/** Refund only this successful attempt, preserving other accounts' or requests' failures. */
|
|
public function releaseAttempt(array $reservation): void {
|
|
$this->transaction(function (&$d) use ($reservation) {
|
|
foreach ($reservation as $id=>$window) {
|
|
if (($d['limits'][$id]['window'] ?? null) !== $window) { continue; }
|
|
if (--$d['limits'][$id]['count'] <= 0) { unset($d['limits'][$id]); }
|
|
}
|
|
});
|
|
}
|
|
/** Throttle non-verification work without refunding successful requests. */
|
|
public function attempt(string $name, string $ip, int $limit = 10): bool {
|
|
return $this->beginAttempt($name, $ip, $limit) !== null;
|
|
}
|
|
}
|