danvics/warden-worker
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat: add validation for key rotation metadata

Browse source
This commit is contained in:
qaz741wsd856 2025-12-06 15:51:42 +00:00
parent 84e35ec032
commit 3ba2f09ea3
1 changed files with 35 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
src/handlers/accounts.rs
View file

@ -20,8 +20,8 @@ use crate::{
cipher::CipherData, cipher::CipherData,
sync::Profile, sync::Profile,
user::{ user::{
ChangeKdfRequest, ChangePasswordRequest, PasswordOrOtpData, PreloginResponse, AvatarData, ChangeKdfRequest, ChangePasswordRequest, MasterPasswordUnlockData,
RegisterRequest, RotateKeyRequest, User, ProfileData, AvatarData, PasswordOrOtpData, PreloginResponse, ProfileData, RegisterRequest, RotateKeyRequest, User,
}, },
}, },
}; };
@ -89,6 +89,37 @@ fn ensure_supported_kdf(
Ok(()) Ok(())
} }
fn validate_rotation_metadata(
user: &User,
unlock_data: &MasterPasswordUnlockData,
account_public_key: &str,
) -> Result<(), AppError> {
let kdf_matches = user.kdf_type == unlock_data.kdf_type
&& user.kdf_iterations == unlock_data.kdf_iterations
&& user.kdf_memory == unlock_data.kdf_memory
&& user.kdf_parallelism == unlock_data.kdf_parallelism;
if user.email != unlock_data.email || !kdf_matches {
log::error!(
"KDF/email mismatch in rotation request: email_equal={}, kdf_equal={}",
user.email == unlock_data.email,
kdf_matches
);
return Err(AppError::BadRequest(
"Changing the kdf variant or email is not supported during key rotation".to_string(),
));
}
if user.public_key != account_public_key {
log::error!("Public key mismatch in rotation request: stored != provided");
return Err(AppError::BadRequest(
"Changing the asymmetric keypair is not supported during key rotation".to_string(),
));
}
Ok(())
}
#[worker::send] #[worker::send]
pub async fn prelogin( pub async fn prelogin(
State(env): State<Arc<Env>>, State(env): State<Arc<Env>>,
@ -555,14 +586,9 @@ pub async fn post_rotatekey(
return Err(AppError::Unauthorized("Invalid password".to_string())); return Err(AppError::Unauthorized("Invalid password".to_string()));
} }
// Validate that email and kdf settings match
let unlock_data = &payload.account_unlock_data.master_password_unlock_data; let unlock_data = &payload.account_unlock_data.master_password_unlock_data;
if user.email != unlock_data.email {
log::error!("Email mismatch in rotation request: {:?} != {:?}", user.email, unlock_data.email); validate_rotation_metadata(&user, unlock_data, &payload.account_keys.account_public_key)?;
return Err(AppError::BadRequest(
"Email mismatch in rotation request".to_string(),
));
}
// Validate KDF parameters // Validate KDF parameters
ensure_supported_kdf( ensure_supported_kdf(