The Tor Browser: comparison services/sync/modules/identity.js

comparison: services/sync/modules/identity.js

services/sync/modules/identity.js

branch: TOR_BUG_9701
changeset 15: b8a032363ba2

equal deleted inserted replaced

--1:000000000000
+:8a11fdd6fb2d
+/* This Source Code Form is subject to the terms of the Mozilla Public
+* License, v. 2.0. If a copy of the MPL was not distributed with this file,
+* You can obtain one at http://mozilla.org/MPL/2.0/. */
+"use strict";
+this.EXPORTED_SYMBOLS = ["IdentityManager"];
+const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://services-sync/constants.js");
+Cu.import("resource://gre/modules/Log.jsm");
+Cu.import("resource://services-sync/util.js");
+// Lazy import to prevent unnecessary load on startup.
+for (let symbol of ["BulkKeyBundle", "SyncKeyBundle"]) {
+XPCOMUtils.defineLazyModuleGetter(this, symbol,
+"resource://services-sync/keys.js",
+symbol);
+}
+/**
+* Manages "legacy" identity and authentication for Sync.
+* See browserid_identity for the Firefox Accounts based identity manager.
+*
+* The following entities are managed:
+*
+*   account - The main Sync/services account. This is typically an email
+*     address.
+*   username - A normalized version of your account. This is what's
+*     transmitted to the server.
+*   basic password - UTF-8 password used for authenticating when using HTTP
+*     basic authentication.
+*   sync key - The main encryption key used by Sync.
+*   sync key bundle - A representation of your sync key.
+*
+* When changes are made to entities that are stored in the password manager
+* (basic password, sync key), those changes are merely staged. To commit them
+* to the password manager, you'll need to call persistCredentials().
+*
+* This type also manages authenticating Sync's network requests. Sync's
+* network code calls into getRESTRequestAuthenticator and
+* getResourceAuthenticator (depending on the network layer being used). Each
+* returns a function which can be used to add authentication information to an
+* outgoing request.
+*
+* In theory, this type supports arbitrary identity and authentication
+* mechanisms. You can add support for them by monkeypatching the global
+* instance of this type. Specifically, you'll need to redefine the
+* aforementioned network code functions to do whatever your authentication
+* mechanism needs them to do. In addition, you may wish to install custom
+* functions to support your API. Although, that is certainly not required.
+* If you do monkeypatch, please be advised that Sync expects the core
+* attributes to have values. You will need to carry at least account and
+* username forward. If you do not wish to support one of the built-in
+* authentication mechanisms, you'll probably want to redefine currentAuthState
+* and any other function that involves the built-in functionality.
+*/
+this.IdentityManager = function IdentityManager() {
+this._log = Log.repository.getLogger("Sync.Identity");
+this._log.Level = Log.Level[Svc.Prefs.get("log.logger.identity")];
+this._basicPassword = null;
+this._basicPasswordAllowLookup = true;
+this._basicPasswordUpdated = false;
+this._syncKey = null;
+this._syncKeyAllowLookup = true;
+this._syncKeySet = false;
+this._syncKeyBundle = null;
+}
+IdentityManager.prototype = {
+_log: null,
+_basicPassword: null,
+_basicPasswordAllowLookup: true,
+_basicPasswordUpdated: false,
+_syncKey: null,
+_syncKeyAllowLookup: true,
+_syncKeySet: false,
+_syncKeyBundle: null,
+/**
+* Initialize the identity provider.  Returns a promise that is resolved
+* when initialization is complete and the provider can be queried for
+* its state
+*/
+initialize: function() {
+// Nothing to do for this identity provider.
+return Promise.resolve();
+},
+finalize: function() {
+// Nothing to do for this identity provider.
+return Promise.resolve();
+},
+/**
+* Called whenever Service.logout() is called.
+*/
+logout: function() {
+// nothing to do for this identity provider.
+},
+/**
+* Ensure the user is logged in.  Returns a promise that resolves when
+* the user is logged in, or is rejected if the login attempt has failed.
+*/
+ensureLoggedIn: function() {
+// nothing to do for this identity provider
+return Promise.resolve();
+},
+/**
+* Indicates if the identity manager is still initializing
+*/
+get readyToAuthenticate() {
+// We initialize in a fully sync manner, so we are always finished.
+return true;
+},
+get account() {
+return Svc.Prefs.get("account", this.username);
+},
+/**
+* Sets the active account name.
+*
+* This should almost always be called in favor of setting username, as
+* username is derived from account.
+*
+* Changing the account name has the side-effect of wiping out stored
+* credentials. Keep in mind that persistCredentials() will need to be called
+* to flush the changes to disk.
+*
+* Set this value to null to clear out identity information.
+*/
+set account(value) {
+if (value) {
+value = value.toLowerCase();
+Svc.Prefs.set("account", value);
+} else {
+Svc.Prefs.reset("account");
+}
+this.username = this.usernameFromAccount(value);
+},
+get username() {
+return Svc.Prefs.get("username", null);
+},
+/**
+* Set the username value.
+*
+* Changing the username has the side-effect of wiping credentials.
+*/
+set username(value) {
+if (value) {
+value = value.toLowerCase();
+if (value == this.username) {
+return;
+}
+Svc.Prefs.set("username", value);
+} else {
+Svc.Prefs.reset("username");
+}
+// If we change the username, we interpret this as a major change event
+// and wipe out the credentials.
+this._log.info("Username changed. Removing stored credentials.");
+this.resetCredentials();
+},
+/**
+* Resets/Drops all credentials we hold for the current user.
+*/
+resetCredentials: function() {
+this.basicPassword = null;
+this.resetSyncKey();
+},
+/**
+* Resets/Drops the sync key we hold for the current user.
+*/
+resetSyncKey: function() {
+this.syncKey = null;
+// syncKeyBundle cleared as a result of setting syncKey.
+},
+/**
+* Obtains the HTTP Basic auth password.
+*
+* Returns a string if set or null if it is not set.
+*/
+get basicPassword() {
+if (this._basicPasswordAllowLookup) {
+// We need a username to find the credentials.
+let username = this.username;
+if (!username) {
+return null;
+}
+for each (let login in this._getLogins(PWDMGR_PASSWORD_REALM)) {
+if (login.username.toLowerCase() == username) {
+// It should already be UTF-8 encoded, but we don't take any chances.
+this._basicPassword = Utils.encodeUTF8(login.password);
+}
+}
+this._basicPasswordAllowLookup = false;
+}
+return this._basicPassword;
+},
+/**
+* Set the HTTP basic password to use.
+*
+* Changes will not persist unless persistSyncCredentials() is called.
+*/
+set basicPassword(value) {
+// Wiping out value.
+if (!value) {
+this._log.info("Basic password has no value. Removing.");
+this._basicPassword = null;
+this._basicPasswordUpdated = true;
+this._basicPasswordAllowLookup = false;
+return;
+}
+let username = this.username;
+if (!username) {
+throw new Error("basicPassword cannot be set before username.");
+}
+this._log.info("Basic password being updated.");
+this._basicPassword = Utils.encodeUTF8(value);
+this._basicPasswordUpdated = true;
+},
+/**
+* Obtain the Sync Key.
+*
+* This returns a 26 character "friendly" Base32 encoded string on success or
+* null if no Sync Key could be found.
+*
+* If the Sync Key hasn't been set in this session, this will look in the
+* password manager for the sync key.
+*/
+get syncKey() {
+if (this._syncKeyAllowLookup) {
+let username = this.username;
+if (!username) {
+return null;
+}
+for each (let login in this._getLogins(PWDMGR_PASSPHRASE_REALM)) {
+if (login.username.toLowerCase() == username) {
+this._syncKey = login.password;
+}
+}
+this._syncKeyAllowLookup = false;
+}
+return this._syncKey;
+},
+/**
+* Set the active Sync Key.
+*
+* If being set to null, the Sync Key and its derived SyncKeyBundle are
+* removed. However, the Sync Key won't be deleted from the password manager
+* until persistSyncCredentials() is called.
+*
+* If a value is provided, it should be a 26 or 32 character "friendly"
+* Base32 string for which Utils.isPassphrase() returns true.
+*
+* A side-effect of setting the Sync Key is that a SyncKeyBundle is
+* generated. For historical reasons, this will silently error out if the
+* value is not a proper Sync Key (!Utils.isPassphrase()). This should be
+* fixed in the future (once service.js is more sane) to throw if the passed
+* value is not valid.
+*/
+set syncKey(value) {
+if (!value) {
+this._log.info("Sync Key has no value. Deleting.");
+this._syncKey = null;
+this._syncKeyBundle = null;
+this._syncKeyUpdated = true;
+return;
+}
+if (!this.username) {
+throw new Error("syncKey cannot be set before username.");
+}
+this._log.info("Sync Key being updated.");
+this._syncKey = value;
+// Clear any cached Sync Key Bundle and regenerate it.
+this._syncKeyBundle = null;
+let bundle = this.syncKeyBundle;
+this._syncKeyUpdated = true;
+},
+/**
+* Obtain the active SyncKeyBundle.
+*
+* This returns a SyncKeyBundle representing a key pair derived from the
+* Sync Key on success. If no Sync Key is present or if the Sync Key is not
+* valid, this returns null.
+*
+* The SyncKeyBundle should be treated as immutable.
+*/
+get syncKeyBundle() {
+// We can't obtain a bundle without a username set.
+if (!this.username) {
+this._log.warn("Attempted to obtain Sync Key Bundle with no username set!");
+return null;
+}
+if (!this.syncKey) {
+this._log.warn("Attempted to obtain Sync Key Bundle with no Sync Key " +
+"set!");
+return null;
+}
+if (!this._syncKeyBundle) {
+try {
+this._syncKeyBundle = new SyncKeyBundle(this.username, this.syncKey);
+} catch (ex) {
+this._log.warn(Utils.exceptionStr(ex));
+return null;
+}
+}
+return this._syncKeyBundle;
+},
+/**
+* The current state of the auth credentials.
+*
+* This essentially validates that enough credentials are available to use
+* Sync.
+*/
+get currentAuthState() {
+if (!this.username) {
+return LOGIN_FAILED_NO_USERNAME;
+}
+if (Utils.mpLocked()) {
+return STATUS_OK;
+}
+if (!this.basicPassword) {
+return LOGIN_FAILED_NO_PASSWORD;
+}
+if (!this.syncKey) {
+return LOGIN_FAILED_NO_PASSPHRASE;
+}
+// If we have a Sync Key but no bundle, bundle creation failed, which
+// implies a bad Sync Key.
+if (!this.syncKeyBundle) {
+return LOGIN_FAILED_INVALID_PASSPHRASE;
+}
+return STATUS_OK;
+},
+/**
+* Persist credentials to password store.
+*
+* When credentials are updated, they are changed in memory only. This will
+* need to be called to save them to the underlying password store.
+*
+* If the password store is locked (e.g. if the master password hasn't been
+* entered), this could throw an exception.
+*/
+persistCredentials: function persistCredentials(force) {
+if (this._basicPasswordUpdated || force) {
+if (this._basicPassword) {
+this._setLogin(PWDMGR_PASSWORD_REALM, this.username,
+this._basicPassword);
+} else {
+for each (let login in this._getLogins(PWDMGR_PASSWORD_REALM)) {
+Services.logins.removeLogin(login);
+}
+}
+this._basicPasswordUpdated = false;
+}
+if (this._syncKeyUpdated || force) {
+if (this._syncKey) {
+this._setLogin(PWDMGR_PASSPHRASE_REALM, this.username, this._syncKey);
+} else {
+for each (let login in this._getLogins(PWDMGR_PASSPHRASE_REALM)) {
+Services.logins.removeLogin(login);
+}
+}
+this._syncKeyUpdated = false;
+}
+},
+/**
+* Deletes the Sync Key from the system.
+*/
+deleteSyncKey: function deleteSyncKey() {
+this.syncKey = null;
+this.persistCredentials();
+},
+hasBasicCredentials: function hasBasicCredentials() {
+// Because JavaScript.
+return this.username && this.basicPassword && true;
+},
+/**
+* Obtains the array of basic logins from nsiPasswordManager.
+*/
+_getLogins: function _getLogins(realm) {
+return Services.logins.findLogins({}, PWDMGR_HOST, null, realm);
+},
+/**
+* Set a login in the password manager.
+*
+* This has the side-effect of deleting any other logins for the specified
+* realm.
+*/
+_setLogin: function _setLogin(realm, username, password) {
+let exists = false;
+for each (let login in this._getLogins(realm)) {
+if (login.username == username && login.password == password) {
+exists = true;
+} else {
+this._log.debug("Pruning old login for " + username + " from " + realm);
+Services.logins.removeLogin(login);
+}
+}
+if (exists) {
+return;
+}
+this._log.debug("Updating saved password for " + username + " in " +
+realm);
+let loginInfo = new Components.Constructor(
+"@mozilla.org/login-manager/loginInfo;1", Ci.nsILoginInfo, "init");
+let login = new loginInfo(PWDMGR_HOST, null, realm, username,
+password, "", "");
+Services.logins.addLogin(login);
+},
+/**
+* Deletes Sync credentials from the password manager.
+*/
+deleteSyncCredentials: function deleteSyncCredentials() {
+for (let host of Utils.getSyncCredentialsHosts()) {
+let logins = Services.logins.findLogins({}, host, "", "");
+for each (let login in logins) {
+Services.logins.removeLogin(login);
+}
+}
+// Wait until after store is updated in case it fails.
+this._basicPassword = null;
+this._basicPasswordAllowLookup = true;
+this._basicPasswordUpdated = false;
+this._syncKey = null;
+// this._syncKeyBundle is nullified as part of _syncKey setter.
+this._syncKeyAllowLookup = true;
+this._syncKeyUpdated = false;
+},
+usernameFromAccount: function usernameFromAccount(value) {
+// If we encounter characters not allowed by the API (as found for
+// instance in an email address), hash the value.
+if (value && value.match(/[^A-Z0-9._-]/i)) {
+return Utils.sha1Base32(value.toLowerCase()).toLowerCase();
+}
+return value ? value.toLowerCase() : value;
+},
+/**
+* Obtain a function to be used for adding auth to Resource HTTP requests.
+*/
+getResourceAuthenticator: function getResourceAuthenticator() {
+if (this.hasBasicCredentials()) {
+return this._onResourceRequestBasic.bind(this);
+}
+return null;
+},
+/**
+* Helper method to return an authenticator for basic Resource requests.
+*/
+getBasicResourceAuthenticator:
+function getBasicResourceAuthenticator(username, password) {
+return function basicAuthenticator(resource) {
+let value = "Basic " + btoa(username + ":" + password);
+return {headers: {authorization: value}};
+};
+},
+_onResourceRequestBasic: function _onResourceRequestBasic(resource) {
+let value = "Basic " + btoa(this.username + ":" + this.basicPassword);
+return {headers: {authorization: value}};
+},
+_onResourceRequestMAC: function _onResourceRequestMAC(resource, method) {
+// TODO Get identifier and key from somewhere.
+let identifier;
+let key;
+let result = Utils.computeHTTPMACSHA1(identifier, key, method, resource.uri);
+return {headers: {authorization: result.header}};
+},
+/**
+* Obtain a function to be used for adding auth to RESTRequest instances.
+*/
+getRESTRequestAuthenticator: function getRESTRequestAuthenticator() {
+if (this.hasBasicCredentials()) {
+return this.onRESTRequestBasic.bind(this);
+}
+return null;
+},
+onRESTRequestBasic: function onRESTRequestBasic(request) {
+let up = this.username + ":" + this.basicPassword;
+request.setHeader("authorization", "Basic " + btoa(up));
+},
+createClusterManager: function(service) {
+Cu.import("resource://services-sync/stages/cluster.js");
+return new ClusterManager(service);
+},
+offerSyncOptions: function () {
+// Do nothing for Sync 1.1.
+return {accepted: true};
+},
+};