Mercurial

comparison auth/auth_crypto.h @ 264:04fee26ecce0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
add authenticated JRPG conversation platform Add reusable auth/session storage, owned conversation recovery, guest quotas, admin workflows, URL-routed conversation UI, mobile frame support, and parallel browser acceptance. Co-authored-by: Copilot <[email protected]>
author MrJuneJune <me@mrjunejune.com>
date Fri, 07 Aug 2026 07:34:12 -0700
parents
children
comparison
equal deleted inserted replaced
263:ee04e4e69fed 264:04fee26ecce0
1 #ifndef ZENBU_AUTH_CRYPTO_H
2 #define ZENBU_AUTH_CRYPTO_H
3
4 #include "dowa/dowa.h"
5
6 #define AUTH_CRYPTO_PASSWORD_MAX_BYTES 1024
7 #define AUTH_CRYPTO_PASSWORD_SALT_BYTES 16
8 #define AUTH_CRYPTO_PASSWORD_HASH_BYTES 32
9 #define AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE 160
10
11 #define AUTH_CRYPTO_TOKEN_BYTES 32
12 #define AUTH_CRYPTO_TOKEN_SIZE 44
13 #define AUTH_CRYPTO_TOKEN_DIGEST_BYTES 32
14 #define AUTH_CRYPTO_TOKEN_DIGEST_SIZE 65
15
16 #define AUTH_CRYPTO_COOKIE_SECRET_MIN_BYTES 32
17 #define AUTH_CRYPTO_COOKIE_SECRET_MAX_BYTES 1024
18 #define AUTH_CRYPTO_IP_MAX_BYTES 128
19 #define AUTH_CRYPTO_IP_BINDING_DIGEST_SIZE 65
20 #define AUTH_CRYPTO_GUEST_UUID_SIZE 37
21 #define AUTH_CRYPTO_GUEST_COOKIE_SIZE 256
22
23 typedef enum {
24 AUTH_CRYPTO_OK = 0,
25 AUTH_CRYPTO_INVALID_ARGUMENT = 1,
26 AUTH_CRYPTO_BUFFER_TOO_SMALL = 2,
27 AUTH_CRYPTO_PASSWORD_TOO_LONG = 3,
28 AUTH_CRYPTO_RANDOM_FAILED = 4,
29 AUTH_CRYPTO_OPERATION_FAILED = 5,
30 AUTH_CRYPTO_MALFORMED = 6,
31 AUTH_CRYPTO_AUTHENTICATION_FAILED = 7,
32 AUTH_CRYPTO_EXPIRED = 8,
33 AUTH_CRYPTO_IP_MISMATCH = 9,
34 } Auth_Crypto_Result;
35
36 typedef struct {
37 char guest_uuid[AUTH_CRYPTO_GUEST_UUID_SIZE];
38 uint64 expiration_unix;
39 } Auth_Crypto_Guest_Cookie;
40
41 Auth_Crypto_Result Auth_Crypto_Password_Hash(
42 const char *password,
43 char *encoded_hash,
44 size_t encoded_hash_capacity);
45
46 Auth_Crypto_Result Auth_Crypto_Password_Verify(
47 const char *password,
48 const char *encoded_hash);
49
50 Auth_Crypto_Result Auth_Crypto_Token_Generate(
51 char *token,
52 size_t token_capacity);
53
54 Auth_Crypto_Result Auth_Crypto_Token_Digest(
55 const char *token,
56 char *digest_hex,
57 size_t digest_hex_capacity);
58
59 Auth_Crypto_Result Auth_Crypto_IP_Binding_Digest(
60 const uint8 *cookie_secret,
61 size_t cookie_secret_length,
62 const char *canonical_peer_ip,
63 char *digest_hex,
64 size_t digest_hex_capacity);
65
66 Auth_Crypto_Result Auth_Crypto_Guest_Cookie_Create(
67 const uint8 *cookie_secret,
68 size_t cookie_secret_length,
69 const char *guest_uuid,
70 uint64 expiration_unix,
71 const char *ip_binding_digest,
72 char *cookie,
73 size_t cookie_capacity);
74
75 Auth_Crypto_Result Auth_Crypto_Guest_Cookie_Verify(
76 const uint8 *cookie_secret,
77 size_t cookie_secret_length,
78 const char *cookie,
79 uint64 current_unix,
80 const char *expected_ip_binding_digest,
81 Auth_Crypto_Guest_Cookie *guest_cookie);
82
83 const char *Auth_Crypto_Result_String(Auth_Crypto_Result result);
84
85 /*
86 * Validate an encoded password hash string without running scrypt.
87 * Checks exact format, version string, parameters (N/r/p), hex salt length,
88 * hex hash length, and that all hex characters are valid.
89 * Returns AUTH_CRYPTO_OK if well-formed, AUTH_CRYPTO_MALFORMED otherwise.
90 * Does NOT verify against a password; use Auth_Crypto_Password_Verify for that.
91 */
92 Auth_Crypto_Result Auth_Crypto_Password_Hash_Validate(const char *encoded_hash);
93
94 /*
95 * Encode byte_count bytes from bytes as unpadded base64url into out.
96 * out_capacity must be at least ((byte_count + 2) / 3 * 4) - padding + 1;
97 * for AUTH_CRYPTO_TOKEN_BYTES (32) bytes that is AUTH_CRYPTO_TOKEN_SIZE (44).
98 * Returns number of characters written (without NUL), or 0 on error.
99 */
100 size_t Auth_Crypto_Base64url_Encode(
101 const uint8 *bytes,
102 size_t byte_count,
103 char *out,
104 size_t out_capacity);
105
106 #endif