443 lines
17 KiB
Python
443 lines
17 KiB
Python
"""Durable active-session registry used to revoke signed operator sessions."""
|
|
|
|
import hashlib
|
|
import secrets
|
|
import sqlite3
|
|
from dataclasses import dataclass
|
|
from pathlib import Path
|
|
from typing import Callable
|
|
|
|
from src.private_state import connect_private_sqlite
|
|
|
|
|
|
class SessionStoreError(RuntimeError):
|
|
"""Raised when session state cannot be read or changed safely."""
|
|
|
|
|
|
class SessionStatus(str):
|
|
"""String-compatible status carrying the server-confirmed idle deadline."""
|
|
|
|
idle_expires_at: int | None
|
|
principal_id: int | None
|
|
principal_login: str | None
|
|
|
|
def __new__(
|
|
cls,
|
|
value: str,
|
|
idle_expires_at: int | None = None,
|
|
principal_id: int | None = None,
|
|
principal_login: str | None = None,
|
|
):
|
|
instance = super().__new__(cls, value)
|
|
instance.idle_expires_at = idle_expires_at
|
|
instance.principal_id = principal_id
|
|
instance.principal_login = principal_login
|
|
return instance
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ActiveDevice:
|
|
management_id: str
|
|
device_label: str
|
|
created_at: int
|
|
expires_at: int
|
|
current: bool
|
|
|
|
|
|
class SessionStore:
|
|
def __init__(
|
|
self,
|
|
path: str | Path,
|
|
*,
|
|
clock: Callable[[], float],
|
|
lock_timeout_seconds: float = 0.1,
|
|
) -> None:
|
|
self.path = Path(path)
|
|
self.clock = clock
|
|
self.lock_timeout_seconds = lock_timeout_seconds
|
|
|
|
@staticmethod
|
|
def _digest(session_id: str) -> str:
|
|
return hashlib.sha256(session_id.encode()).hexdigest()
|
|
|
|
def _connect(self, *, initialize: bool = False) -> sqlite3.Connection:
|
|
try:
|
|
if initialize:
|
|
connection = connect_private_sqlite(
|
|
self.path, timeout=self.lock_timeout_seconds
|
|
)
|
|
else:
|
|
connection = connect_private_sqlite(
|
|
self.path,
|
|
timeout=self.lock_timeout_seconds,
|
|
existing_only=True,
|
|
)
|
|
if initialize:
|
|
connection.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS active_sessions (
|
|
session_hash TEXT PRIMARY KEY,
|
|
expires_at INTEGER NOT NULL,
|
|
management_id TEXT,
|
|
device_label TEXT,
|
|
created_at INTEGER,
|
|
last_active_at INTEGER,
|
|
principal_id INTEGER,
|
|
principal_login TEXT
|
|
)
|
|
"""
|
|
)
|
|
connection.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS step_up_grants (
|
|
grant_hash TEXT PRIMARY KEY,
|
|
session_hash TEXT NOT NULL,
|
|
action TEXT NOT NULL,
|
|
target TEXT NOT NULL,
|
|
expires_at INTEGER NOT NULL
|
|
)
|
|
"""
|
|
)
|
|
connection.execute(
|
|
"CREATE INDEX IF NOT EXISTS step_up_grants_session_hash "
|
|
"ON step_up_grants(session_hash)"
|
|
)
|
|
columns = {
|
|
row[1] for row in connection.execute("PRAGMA table_info(active_sessions)")
|
|
}
|
|
additions = {
|
|
"management_id": "TEXT",
|
|
"device_label": "TEXT",
|
|
"created_at": "INTEGER",
|
|
"last_active_at": "INTEGER",
|
|
"principal_id": "INTEGER",
|
|
"principal_login": "TEXT",
|
|
}
|
|
for name, column_type in additions.items():
|
|
if name not in columns:
|
|
connection.execute(
|
|
f"ALTER TABLE active_sessions ADD COLUMN {name} {column_type}"
|
|
)
|
|
connection.execute(
|
|
"UPDATE active_sessions SET management_id = lower(hex(randomblob(16))) "
|
|
"WHERE management_id IS NULL"
|
|
)
|
|
connection.execute(
|
|
"UPDATE active_sessions SET device_label = 'Existing device' "
|
|
"WHERE device_label IS NULL"
|
|
)
|
|
connection.execute(
|
|
"UPDATE active_sessions SET created_at = ? WHERE created_at IS NULL",
|
|
(int(self.clock()),),
|
|
)
|
|
connection.execute(
|
|
"UPDATE active_sessions SET last_active_at = ? WHERE last_active_at IS NULL",
|
|
(int(self.clock()),),
|
|
)
|
|
connection.execute(
|
|
"CREATE UNIQUE INDEX IF NOT EXISTS active_sessions_management_id "
|
|
"ON active_sessions(management_id)"
|
|
)
|
|
return connection
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
|
|
def activate(
|
|
self,
|
|
session_id: str,
|
|
expires_at: int,
|
|
*,
|
|
device_label: str = "This device",
|
|
management_id: str | None = None,
|
|
principal_id: int | None = None,
|
|
principal_login: str | None = None,
|
|
) -> None:
|
|
label = " ".join(str(device_label).split())[:64] or "This device"
|
|
now = int(self.clock())
|
|
try:
|
|
with self._connect(initialize=True) as connection:
|
|
connection.execute(
|
|
"DELETE FROM active_sessions WHERE expires_at <= ?", (now,)
|
|
)
|
|
connection.execute(
|
|
"INSERT INTO active_sessions("
|
|
"session_hash, expires_at, management_id, device_label, created_at, last_active_at, "
|
|
"principal_id, principal_login"
|
|
") VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
|
|
(
|
|
self._digest(session_id),
|
|
expires_at,
|
|
management_id or secrets.token_urlsafe(18),
|
|
label,
|
|
now,
|
|
now,
|
|
principal_id,
|
|
principal_login,
|
|
),
|
|
)
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
|
|
def is_active(self, session_id: str, expires_at: int) -> bool:
|
|
now = int(self.clock())
|
|
try:
|
|
with self._connect() as connection:
|
|
row = connection.execute(
|
|
"SELECT expires_at FROM active_sessions WHERE session_hash = ?",
|
|
(self._digest(session_id),),
|
|
).fetchone()
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
return row is not None and row[0] == expires_at and expires_at > now
|
|
|
|
def status(
|
|
self, session_id: str, expires_at: int, *, idle_timeout_seconds: int
|
|
) -> str:
|
|
now = int(self.clock())
|
|
query = (
|
|
"SELECT expires_at, last_active_at, principal_id, principal_login "
|
|
"FROM active_sessions "
|
|
"WHERE session_hash = ?"
|
|
)
|
|
parameters = (self._digest(session_id),)
|
|
try:
|
|
try:
|
|
with self._connect() as connection:
|
|
row = connection.execute(query, parameters).fetchone()
|
|
except sqlite3.OperationalError as exc:
|
|
missing_migrated_column = any(
|
|
f"no such column: {name}" in str(exc)
|
|
for name in ("last_active_at", "principal_id", "principal_login")
|
|
)
|
|
if not missing_migrated_column:
|
|
raise
|
|
with self._connect(initialize=True) as connection:
|
|
row = connection.execute(query, parameters).fetchone()
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
if row is None or row[0] != expires_at or expires_at <= now:
|
|
return SessionStatus("revoked")
|
|
idle_expires_at = min(row[0], row[1] + max(1, idle_timeout_seconds))
|
|
if idle_expires_at <= now:
|
|
return SessionStatus("idle", idle_expires_at)
|
|
return SessionStatus("active", idle_expires_at, row[2], row[3])
|
|
|
|
def touch(
|
|
self, session_id: str, expires_at: int, *, idle_timeout_seconds: int
|
|
) -> bool:
|
|
now = int(self.clock())
|
|
try:
|
|
with self._connect() as connection:
|
|
cursor = connection.execute(
|
|
"UPDATE active_sessions SET last_active_at = ? "
|
|
"WHERE session_hash = ? AND expires_at = ? AND expires_at > ? "
|
|
"AND last_active_at + ? > ?",
|
|
(
|
|
now,
|
|
self._digest(session_id),
|
|
expires_at,
|
|
now,
|
|
max(1, idle_timeout_seconds),
|
|
now,
|
|
),
|
|
)
|
|
return cursor.rowcount == 1
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
|
|
def revoke(self, session_id: str) -> None:
|
|
try:
|
|
with self._connect(initialize=True) as connection:
|
|
connection.execute(
|
|
"DELETE FROM step_up_grants WHERE session_hash = ?",
|
|
(self._digest(session_id),),
|
|
)
|
|
connection.execute(
|
|
"DELETE FROM active_sessions WHERE session_hash = ?",
|
|
(self._digest(session_id),),
|
|
)
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
|
|
def list_active(self, current_session_id: str) -> list[ActiveDevice]:
|
|
now = int(self.clock())
|
|
current_hash = self._digest(current_session_id)
|
|
try:
|
|
with self._connect() as connection:
|
|
rows = connection.execute(
|
|
"SELECT management_id, device_label, created_at, expires_at, session_hash "
|
|
"FROM active_sessions WHERE expires_at > ? "
|
|
"ORDER BY expires_at DESC, created_at DESC",
|
|
(now,),
|
|
).fetchall()
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
return [
|
|
ActiveDevice(
|
|
management_id=row[0],
|
|
device_label=row[1],
|
|
created_at=row[2],
|
|
expires_at=row[3],
|
|
current=secrets.compare_digest(row[4], current_hash),
|
|
)
|
|
for row in rows
|
|
]
|
|
|
|
def management_id(self, session_id: str) -> str:
|
|
try:
|
|
with self._connect() as connection:
|
|
row = connection.execute(
|
|
"SELECT management_id FROM active_sessions WHERE session_hash = ?",
|
|
(self._digest(session_id),),
|
|
).fetchone()
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
if row is None:
|
|
raise SessionStoreError("Session is no longer active")
|
|
return row[0]
|
|
|
|
def managed_status(self, management_id: str, *, idle_timeout_seconds: int) -> str:
|
|
"""Return the authorization state for a durable device identifier."""
|
|
return self.managed_statuses(
|
|
[management_id], idle_timeout_seconds=idle_timeout_seconds
|
|
)[management_id]
|
|
|
|
def managed_statuses(
|
|
self,
|
|
management_ids,
|
|
*,
|
|
idle_timeout_seconds: int,
|
|
expected_principal_id: int | None = None,
|
|
) -> dict[str, str]:
|
|
"""Return authorization states for durable device identifiers in one read."""
|
|
requested = set(management_ids)
|
|
if not requested:
|
|
return {}
|
|
now = int(self.clock())
|
|
try:
|
|
with self._connect() as connection:
|
|
placeholders = ",".join("?" for _ in requested)
|
|
rows = connection.execute(
|
|
"SELECT management_id, expires_at, last_active_at, principal_id "
|
|
f"FROM active_sessions WHERE management_id IN ({placeholders})",
|
|
tuple(requested),
|
|
).fetchall()
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
known = {row[0]: row[1:] for row in rows if row[0] in requested}
|
|
idle_timeout = max(1, idle_timeout_seconds)
|
|
statuses = {}
|
|
for management_id in requested:
|
|
row = known.get(management_id)
|
|
if row is None or row[0] <= now:
|
|
statuses[management_id] = "revoked"
|
|
elif row[1] + idle_timeout <= now:
|
|
statuses[management_id] = "idle"
|
|
elif expected_principal_id is not None and row[2] != expected_principal_id:
|
|
statuses[management_id] = "principal_mismatch"
|
|
else:
|
|
statuses[management_id] = "active"
|
|
return statuses
|
|
|
|
def revoke_managed(self, management_id: str) -> bool:
|
|
try:
|
|
with self._connect() as connection:
|
|
row = connection.execute(
|
|
"SELECT session_hash FROM active_sessions WHERE management_id = ?",
|
|
(management_id,),
|
|
).fetchone()
|
|
if row is None:
|
|
return False
|
|
connection.execute(
|
|
"DELETE FROM step_up_grants WHERE session_hash = ?", (row[0],)
|
|
)
|
|
cursor = connection.execute(
|
|
"DELETE FROM active_sessions WHERE management_id = ?", (management_id,)
|
|
)
|
|
return cursor.rowcount == 1
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
|
|
def revoke_all(self) -> None:
|
|
try:
|
|
with self._connect(initialize=True) as connection:
|
|
connection.execute("DELETE FROM step_up_grants")
|
|
connection.execute("DELETE FROM active_sessions")
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
|
|
def mint_step_up(
|
|
self,
|
|
session_id: str,
|
|
*,
|
|
action: str,
|
|
target: str,
|
|
ttl_seconds: int,
|
|
) -> str:
|
|
now = int(self.clock())
|
|
grant = secrets.token_urlsafe(32)
|
|
session_hash = self._digest(session_id)
|
|
try:
|
|
with self._connect(initialize=True) as connection:
|
|
active = connection.execute(
|
|
"SELECT 1 FROM active_sessions "
|
|
"WHERE session_hash = ? AND expires_at > ?",
|
|
(session_hash, now),
|
|
).fetchone()
|
|
if active is None:
|
|
raise SessionStoreError("Session is no longer active")
|
|
connection.execute(
|
|
"DELETE FROM step_up_grants WHERE expires_at <= ?", (now,)
|
|
)
|
|
connection.execute(
|
|
"INSERT INTO step_up_grants("
|
|
"grant_hash, session_hash, action, target, expires_at"
|
|
") VALUES (?, ?, ?, ?, ?)",
|
|
(
|
|
self._digest(grant),
|
|
session_hash,
|
|
action,
|
|
target,
|
|
now + max(1, ttl_seconds),
|
|
),
|
|
)
|
|
except SessionStoreError:
|
|
raise
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|
|
return grant
|
|
|
|
def consume_step_up(
|
|
self,
|
|
grant: str,
|
|
session_id: str,
|
|
*,
|
|
action: str,
|
|
target: str,
|
|
) -> bool:
|
|
now = int(self.clock())
|
|
try:
|
|
with self._connect() as connection:
|
|
connection.execute(
|
|
"DELETE FROM step_up_grants WHERE expires_at <= ?", (now,)
|
|
)
|
|
cursor = connection.execute(
|
|
"DELETE FROM step_up_grants WHERE grant_hash = ? "
|
|
"AND session_hash = ? AND action = ? AND target = ? "
|
|
"AND expires_at > ? AND EXISTS ("
|
|
"SELECT 1 FROM active_sessions "
|
|
"WHERE active_sessions.session_hash = step_up_grants.session_hash "
|
|
"AND active_sessions.expires_at > ?)",
|
|
(
|
|
self._digest(grant),
|
|
self._digest(session_id),
|
|
action,
|
|
target,
|
|
now,
|
|
now,
|
|
),
|
|
)
|
|
return cursor.rowcount == 1
|
|
except (OSError, sqlite3.Error) as exc:
|
|
raise SessionStoreError("Session registry is temporarily unavailable") from exc
|