Mercurial

comparison connectors/auth_http_adapter.c @ 279:b3b547563ec7

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add Google connector service and agent wiki Implement the C/Seobeo Google Drive and Gmail connector with encrypted OAuth storage, Zenbu authentication, browser testing, AI tool discovery, chunked HTTP decoding, and Bazel coverage. Consolidate repository guidance into progressive wiki documentation and enforce arena-first allocation for new first-party C code. Co-authored-by: Copilot <[email protected]> Copilot-Session: 84c338fd-0939-4bb3-b7f3-1062eb213e5d
author MrJuneJune <me@mrjunejune.com>
date Mon, 17 Aug 2026 22:22:36 -0700
parents
children
comparison
equal deleted inserted replaced
278:8d560f50ed4c 279:b3b547563ec7
1 #include "connectors/auth_http_adapter.h"
2
3 #include <openssl/crypto.h>
4
5 #include <string.h>
6 #include <time.h>
7
8 static int32 hex_value(char value)
9 {
10 if (value >= '0' && value <= '9')
11 return value - '0';
12 if (value >= 'a' && value <= 'f')
13 return value - 'a' + 10;
14 if (value >= 'A' && value <= 'F')
15 return value - 'A' + 10;
16 return -1;
17 }
18
19 static boolean decode_secret(
20 const char *hex, uint8 *output, size_t capacity, size_t *length_out)
21 {
22 if (!hex || !output || !length_out)
23 return FALSE;
24 size_t length = strlen(hex);
25 if (length % 2 != 0 || length / 2 > capacity ||
26 length / 2 < AUTH_CRYPTO_COOKIE_SECRET_MIN_BYTES)
27 return FALSE;
28 for (size_t i = 0; i < length; i += 2) {
29 int32 high = hex_value(hex[i]);
30 int32 low = hex_value(hex[i + 1]);
31 if (high < 0 || low < 0) {
32 OPENSSL_cleanse(output, capacity);
33 return FALSE;
34 }
35 output[i / 2] = (uint8)((high << 4) | low);
36 }
37 *length_out = length / 2;
38 return TRUE;
39 }
40
41 boolean Connector_Auth_HTTP_Init(
42 Connector_Auth_HTTP_Context *context,
43 const char *database_path,
44 const char *cookie_secret_hex,
45 int64 session_idle_ttl_secs)
46 {
47 if (!context || !database_path || !cookie_secret_hex ||
48 session_idle_ttl_secs <= 0)
49 return FALSE;
50 memset(context, 0, sizeof(*context));
51 if (!decode_secret(
52 cookie_secret_hex, context->cookie_secret,
53 sizeof(context->cookie_secret), &context->cookie_secret_length))
54 return FALSE;
55 context->store = Auth_Store_Create(database_path);
56 if (!context->store) {
57 OPENSSL_cleanse(context->cookie_secret, sizeof(context->cookie_secret));
58 context->cookie_secret_length = 0;
59 return FALSE;
60 }
61 context->session_idle_ttl_secs = session_idle_ttl_secs;
62 return TRUE;
63 }
64
65 void Connector_Auth_HTTP_Destroy(Connector_Auth_HTTP_Context *context)
66 {
67 if (!context)
68 return;
69 if (context->store)
70 Auth_Store_Destroy(context->store);
71 OPENSSL_cleanse(context, sizeof(*context));
72 }
73
74 static const char *resolve_user(
75 Seobeo_Request_Entry *request,
76 boolean require_csrf,
77 Dowa_Arena *arena,
78 void *opaque)
79 {
80 Connector_Auth_HTTP_Context *context = opaque;
81 if (!context || !context->store || !arena)
82 return NULL;
83 Auth_HTTP_Authenticated_User authenticated;
84 Auth_HTTP_Resolve_Result result = Auth_HTTP_Resolve_Authenticated_User(
85 request, context->store, context->cookie_secret,
86 context->cookie_secret_length, (int64)time(NULL),
87 context->session_idle_ttl_secs, &authenticated);
88 if (result != AUTH_HTTP_RESOLVE_OK)
89 return NULL;
90 if (require_csrf && !Auth_HTTP_Verify_CSRF(
91 request, context->cookie_secret, context->cookie_secret_length,
92 authenticated.token_digest)) {
93 OPENSSL_cleanse(&authenticated, sizeof(authenticated));
94 return NULL;
95 }
96 size_t id_length = strlen(authenticated.user.id);
97 char *user_id = Dowa_Arena_Allocate(arena, id_length + 1);
98 if (user_id)
99 memcpy(user_id, authenticated.user.id, id_length + 1);
100 OPENSSL_cleanse(&authenticated, sizeof(authenticated));
101 return user_id;
102 }
103
104 static boolean resolve_session(
105 Seobeo_Request_Entry *request,
106 Connector_Auth_Session *session,
107 void *opaque)
108 {
109 Connector_Auth_HTTP_Context *context = opaque;
110 if (!context || !context->store || !session)
111 return FALSE;
112 Auth_HTTP_Authenticated_User authenticated;
113 Auth_HTTP_Resolve_Result result = Auth_HTTP_Resolve_Authenticated_User(
114 request, context->store, context->cookie_secret,
115 context->cookie_secret_length, (int64)time(NULL),
116 context->session_idle_ttl_secs, &authenticated);
117 if (result != AUTH_HTTP_RESOLVE_OK)
118 return FALSE;
119 memset(session, 0, sizeof(*session));
120 snprintf(session->user_id, sizeof(session->user_id), "%s",
121 authenticated.user.id);
122 snprintf(session->username, sizeof(session->username), "%s",
123 authenticated.user.username);
124 snprintf(session->role, sizeof(session->role), "%s",
125 authenticated.user.role);
126 snprintf(session->csrf_token, sizeof(session->csrf_token), "%s",
127 authenticated.csrf_token);
128 OPENSSL_cleanse(&authenticated, sizeof(authenticated));
129 return TRUE;
130 }
131
132 Connector_Auth_Adapter Connector_Auth_HTTP_Create_Adapter(
133 Connector_Auth_HTTP_Context *context)
134 {
135 Connector_Auth_Adapter adapter = {
136 .resolve_user = resolve_user,
137 .resolve_session = resolve_session,
138 .context = context
139 };
140 return adapter;
141 }