OAuth2 Saved Login Session Mechanism

auth/api/index.php

@@ -0,0 +1,71 @@
+<?php
+
+$config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
+
+require_once("/var/www/usergen/secret/helpers.php");
+require_once("/var/www/usergen/secret/oauth.php");
+require_once("/var/www/usergen/secret/rsa.php");
+
+if (isset($_REQUEST["act"])) {
+    // internal functions such as id request
+    switch($_REQUEST["act"]){
+        case "id":
+            // return OAUTH app ID
+            header('Content-type: application/json');
+            echo json_encode(array("id" => $config->oauth->key));
+            exit();
+            break;
+        case "login":
+            if (isset($_REQUEST["code"])){
+                // Mastodon callback (Authorization Code from /oauth/authorize)
+                $authCode = $_REQUEST["code"];
+                $Auth = oauthToken($authCode, $config);
+                if(isset($Auth->token_type)){
+                    // Valid Auth?
+                    $User = verifyCredentials($Auth->access_token);
+                    if (gettype($User) == "object" && isset($User->id)) {
+                        // Congrats!
+                        returnSuccess($User, buildEncToken($Auth->access_token, $User->id, $_SERVER["REMOTE_ADDR"], $_SERVER["HTTP_USER_AGENT"]));
+                    }else{
+                        // invalid auth
+                        // $User contains error string
+                        returnError($User);
+                    }
+                }else{
+                    // invalid auth
+                    returnError($Auth);
+                }
+            }else{
+                returnError("Incorrect Login Query");
+            }
+            break;
+        case "verify":
+            if (isset($_REQUEST["token"])){
+                // Verify Encrypted Token
+                $EncTokenData = $_REQUEST["token"];
+                $TokenData = verifyEncToken($EncTokenData);
+                if (gettype($TokenData) == "string") {
+                    // Invalid Token
+                    returnError($TokenData);
+                }else{
+                    // Valid Token
+                    returnSuccess($TokenData["MastodonData"],
+                        buildEncToken($TokenData["AuthToken"],
+                            $TokenData["UserID"],
+                            $_SERVER["REMOTE_ADDR"],
+                            $_SERVER["HTTP_USER_AGENT"]
+                        )
+                    );
+                }
+            }else{
+                returnError("Incorrect Verify Query");
+            }
+            break;
+        default:
+            returnError("Incorrect Action Query");
+            break;
+    }
+}else {
+    returnError("Incorrect Empty Query");
+}
+?>

auth/auth.js

@@ -0,0 +1,289 @@
+var DEBUG = false;
+var isMobile = false;
+var USE_ORIGIN = "";
+
+const SwalConfig = {
+  color: "#79F257",
+  background: "#022601",
+  buttonsStyling: false,
+};
+
+const invalidChars = ["/", "\\", ">", "<", ":", "*", "|", '"', "'", "?", "\0"];
+
+const failMsg = (msg) => {
+  Swal.fire({
+    ...SwalConfig,
+    title: "Error!",
+    text: msg,
+  });
+};
+
+const replaceInvalid = (str) => {
+  var cache = str;
+  invalidChars.forEach((ch) => {
+    cache = cache.replaceAll(ch, "#");
+  });
+  return cache;
+};
+
+const post = (url, data, callback) => {
+  var settings = {
+    url: url,
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    data: data
+  };
+  $.ajax(settings).done(callback);
+};
+
+const saveFile = (name, type, data) => {
+  if (data !== null && navigator.msSaveBlob)
+    return navigator.msSaveBlob(new Blob([data], { type: type }), name);
+  var a = $("<a style='display: none;'/>");
+  var url = window.URL.createObjectURL(new Blob([data], { type: type }));
+  a.attr("href", url);
+  a.attr("download", name);
+  $("body").append(a);
+  a[0].click();
+  window.URL.revokeObjectURL(url);
+  a.remove();
+};
+
+const validatePubKey = (key) => {
+  return /^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/.test(
+    key
+  );
+};
+
+const sendSSH = (key, id, token) => {
+  var payload = {
+    pubkey: key,
+    token: token,
+  };
+  post(USE_ORIGIN + "/auth/setKey.php", payload, (response) => {
+    if (!response.error) {
+      localStorage.setItem("tty_token", response.refreshToken);
+      Swal.fire({
+        ...SwalConfig,
+        title: "Success!",
+        text: "Your key has been uploaded to the server.",
+      });
+    } else {
+      Swal.fire({
+        ...SwalConfig,
+        title: "Failed!",
+        text: response.error,
+      }).then(() => {
+        window.location.reload();
+      });
+    }
+  });
+};
+
+const generateSSH = async () => {
+  if (window.location.protocol === "http:") {
+    Swal.fire({
+      ...SwalConfig,
+      title: "Error!",
+      text: "You must use HTTPS to generate keys.",
+    });
+    return;
+  }
+  var token = localStorage.getItem("tty_token");
+  var userData = localStorage.getItem("tty_userData");
+  if (!token || !userData) {
+    failMsg("Not Logged In");
+    return;
+  }
+  userData = JSON.parse(userData);
+  generateKeyPair("RSASSA-PKCS1-v1_5", 4096, "WebGen " + Date())
+    .then((keys) => {
+      var KeyExport = new JSZip();
+      var name = replaceInvalid(userData.username);
+      KeyExport.file("HackersTownTTY-" + name, keys[0]);
+      KeyExport.file("HackersTownTTY-" + name + ".pub", keys[1]);
+      KeyExport.generateAsync({ type: "blob" }).then((content) => {
+        saveFile("HackersTownTTY-" + name + ".zip", "application/zip", content);
+      });
+      sendSSH(keys[1], userData.id, token);
+    })
+    .catch((err) => {
+      console.log(err);
+      failMsg("Failed to generate keypair locally.");
+    });
+};
+
+const testSwal = () => {
+  Swal.fire({
+    ...SwalConfig,
+    title: "Success!",
+  });
+};
+
+const uploadSSH = () => {
+  var token = localStorage.getItem("tty_token");
+  var userData = localStorage.getItem("tty_userData");
+  if (!token || !userData) {
+    failMsg("Not Logged In");
+    return;
+  }
+  userData = JSON.parse(userData);
+  //request local file
+  var kf = document.getElementById("keyfile");
+  kf.onchange = function (e) {
+    // File selected
+    var file = e.target.files[0];
+    if (file) {
+      var reader = new FileReader();
+      reader.readAsText(file, "UTF-8");
+      reader.onload = function (evt) {
+        var pubkey = evt.target.result;
+        pubkey = pubkey.replace(/\r\n/g, "\n");
+        pubkey = pubkey.replace(/\n/g, "");
+        if (validatePubKey(pubkey)) {
+          sendSSH(pubkey, userData.id, token);
+        } else {
+          failMsg("Invalid key");
+        }
+      };
+      reader.onerror = function (evt) {
+        failMsg("Unable to load Keyfile");
+      };
+    }
+  };
+  kf.click();
+};
+
+const displayFingerprints = () => {
+  // Get SSH Fingerprints and display them
+  $.get(USE_ORIGIN + "/fingerprint.php", (response) => {
+    dbp(response);
+    if (response) {
+      var html =
+        '<div><table class="fingerprintTable"><tr><th>Bits</th><th>Fingerprint (SHA256)</th><th class="text-start">Algorithm</th></tr>';
+      response.split("\n").forEach((line) => {
+        var parts = line.split(" ");
+        if (parts.length === 4) {
+          html +=
+            '<tr><td class="fingerprintBit">' +
+            parts[0] +
+            '</td><td class="fingerprintData">' +
+            parts[1].replace("SHA256:", "") +
+            '</td><td class="fingerprintAlgo">' +
+            parts[3].replace("(", "").replace(")", "") +
+            "</td></tr>";
+        }
+      });
+      html += "</table></div>";
+      Swal.fire({
+        ...SwalConfig,
+        title: "SSH Fingerprints",
+        html: html,
+      });
+    } else {
+      Swal.fire({
+        ...SwalConfig,
+        title: "Unable to Lookup SSH Fingerprints",
+        text: response.error,
+      });
+    }
+  });
+};
+
+const checkLogin = () => {
+  // check login status
+  var token = localStorage.getItem("tty_token");
+  if (token){
+    var settings = {
+      url: USE_ORIGIN + "/auth/api/index.php",
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      data: {
+        act: "verify",
+        token: token
+      }
+    };
+    $.ajax(settings).done(function (response) {
+      if(response.error){
+        localStorage.removeItem("tty_token");
+        localStorage.removeItem("tty_userData");
+        window.location.href = "/?error=" + response.error;
+      }else {
+        localStorage.setItem("tty_token", response.refreshToken);
+        localStorage.setItem("tty_userData", JSON.stringify(response.data));
+        document.getElementById("resizer").innerHTML = response.data.display_name;
+      }
+    });
+  }else {
+    window.location.href = "/";
+  }
+};
+
+const logout = () => {
+  localStorage.removeItem("tty_token");
+  localStorage.removeItem("tty_userData");
+  window.location.href = "/?msg=End%20Of%20Line.";
+};
+
+$(() => {
+  // On Page Load
+  // Override domain
+  $.get("/DOMAIN_OVERRIDE", function (data) {
+    USE_ORIGIN = data.replaceAll("\n", "");
+    DEBUG = true;
+  }).fail(() => {
+    USE_ORIGIN = "https://tty.hackers.town";
+  }).always(() => {
+    // Handle Mobile
+    if ( /(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|ipad|iris|kindle|Android|Silk|lge |maemo|midp|mmp|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i
+            .test(navigator.userAgent ) ||
+            /1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i
+            .test(navigator.userAgent.substr(0, 4)
+        )) {
+        isMobile = true;
+    }
+    if (isMobile) {
+        disableNonDesktopElements();
+    }
+    // Handle Auth
+    var authCode = new URL(window.location.href).searchParams.get("code");
+    if (authCode) {
+        // Mastodon OAuth2 Redirected here
+        var settings = {
+          "url": USE_ORIGIN + "/auth/api/index.php",
+          "method": "POST",
+          "headers": {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          "data": {
+            act: "login",
+            code: authCode
+          }
+        };
+        $.ajax(settings).done(function (response) {
+          if(response.error){
+            checkLogin();
+          }else{
+            localStorage.setItem("tty_token", response.refreshToken);
+            localStorage.setItem("tty_userData", JSON.stringify(response.data));
+            document.getElementById("resizer").innerHTML = response.data.display_name;
+          }
+        });
+    } else {
+        // direct connect or from /
+        checkLogin();
+    }
+    // Console Welcome
+    console.log("%cWelcome Hacker!", "color: #ff0000; font-size: 7em; font-style: italic; font-family: 'Times New Roman', Times, serif;");
+    // Enable Extra Debug Stuff
+    if(DEBUG){
+      $('.debug').each((i,e)=>{
+        e.style.display = "unset";
+      });
+    }
+  });
+});

auth/index.php

@@ -1,149 +1,43 @@
 <?php
     $config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
-
     require_once("/var/www/usergen/secret/helpers.php");
-
-require_once("/var/www/usergen/secret/oauth.php");
-
-if (isset($_REQUEST["act"])){
-    // internal functions such as id request
-    switch($_REQUEST["act"]){
-        case "id":
-            // return OAUTH app ID
-            header('Content-type: application/json');
-            echo json_encode(array("id" => $config->oauth->key));
-            exit();
-            break;
-        default:
-            break;
-    }
-}else if (isset($_REQUEST["code"])){
-    // Mastodon callback (Authorization Code from /oauth/authorize)
-    $MastCode = $_REQUEST["code"];
-    // var_dump($_REQUEST);
-}
 ?>
 <!DOCTYPE html>
 <HTML lang="en">
-    <Head>
+    <?php require("/var/www/usergen/elements/head.php"); ?>
-        <Title>HackersTown Server Access</Title>
+    <Body>
-        <meta charset="utf-8">
-        <base href="/auth"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1">
-        <!-- Javascript -->
-        <script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
-        <script src="https://code.jquery.com/color/jquery.color.plus-names-2.1.2.min.js"></script>
-        <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
-        <script src="https://cdn.jsdelivr.net/npm/jszip@3.9.1/dist/jszip.min.js" integrity="sha256-aSPPIlJfSHQ5T7wunbPcp7tM0rlq5dHoUGeN8O5odMg=" crossorigin="anonymous"></script>
-        <script src="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.all.min.js" crossorigin="anonymous"></script>
         <script src="/base64url.js"></script>
         <script src="/ssh-util.js"></script>
         <script src="/keygen.js"></script>
-        <script src="/fittext.js"></script>
+        <script src="/auth/auth.js"></script>
-        <script src="/index.js"></script>
-        <!-- Stylesheets -->
-        <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
-        <link href="/style.css" rel="stylesheet"/>
-    </Head>
-    <Body>
         <div class="row">
             <div class="desktopOnly col-4"></div>
             <div id="content" class="col-4 center">
+                <?php require("/var/www/usergen/elements/logo.php"); ?>
                 <div class="row">
-                    <?php if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
-                        echo "<a href=\"".file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE")."\">";
-                    }else{
-                        echo "<a href=\"https://tty.hackers.town\">";
-                    }?>
-                        <img src="/Assets/HTown.png" class="logo self-align-center mx-auto d-block" alt="Hacker Town logo in ASCII art. Rendered as image to force correct visualization."/>
-                    </a>
-                </div>
-                <?php
-                    // Query /oauth/token
-                    $Auth = oauthToken($MastCode, $config);
-                    if(isset($Auth->token_type)){
-                        // Valid Auth?
-                        $User = verifyCredentials($Auth->access_token);
-                        if (gettype($User) == "object" && isset($User->id)) {
-                            // Congrats!
-                            $AuthToken = $Auth->access_token;
-                            $UserName = $User->display_name;
-                            $UserId = $User->id;
-                        }else{
-                            // invalid auth
-                            $AuthToken = "BadUser";
-                            $ErrorDesc = "User Not Found";
-                        }
-
-                    }else{
-                        // invalid auth
-                        // TODO: Replace with direct to index logout with error msg
-                        if(isset($_COOKIE["oa_retries"])){
-                            $retries = $_COOKIE["oa_retries"];
-                            if($retries >= 3){
-                                $AuthToken = "BadUser";
-                                $ErrorDesc = "Invalid OAuth";
-                                setcookie("oa_retries", 0, time()+3600);
-                            }else{
-                                $retries++;
-                                setcookie("oa_retries", $retries, time()+3600);
-                                $AuthToken = "BadOauthRetry";
-                                $ErrorDesc = "Invalid OAuth Retry";
-                            }
-                        }else{
-                            $AuthToken = "BadOauth";
-                            $ErrorDesc = "Invalid OAuth Retry";
-                            setcookie("oa_retries", 1, time()+3600);
-                        }
-                    }
-
-                    // revoke token after usage
-                ?>
-                <div id="usertoken" ><?php echo $AuthToken; ?></div>
-                <div class="row"<?php if(strpos($AuthToken, "Bad") === false){
-                    echo "hidden";
-                }?>>
-                    <span>
-                        Invalid
-                    </span>
-                    <span>
-                        try again
-                    </span>
-                    <div id="ErrorResult" class="message">
-                        <?php echo $ErrorDesc; ?>
-                    </div>
-                </div><div class="row button"<?php if(strpos($AuthToken, "Bad") === false){
-                    echo "hidden";
-                }?>>
-                    <button class="col keyButton" onclick="beginOauth()">Retry</button>
-                </div>
-                <div class="row"<?php if(strpos($AuthToken, "Bad") !== false){
-                    echo "hidden";
-                }?>>
                     <span>
                         <?php
-                            $Welcomes = array("Welcome", "Dobrodošli", "Vitejte", "Welkom", "Tervetuloa", "Willkommen", "Fáilte", "Benvenuto", "Bienvenidos", "Välkommen", "ようこそ");
+                            echo getHello();
-                            echo $Welcomes[array_rand($Welcomes)];
                         ?>
                     </span>
                     <span id="resizer">
-                        <?php echo $UserName; ?>
                     </span>
                     <div class="message">
                         Setup an account SSH key
                     </div>
                 </div>
-                <div class="row button" <?php if(strpos($AuthToken, "Bad") !== false){
+                <div class="row button">
-                    echo "hidden";
+                    <button class="col keyButton" onclick="generateSSH()">Generate</button>
-                }?>>
+                    <button class="col keyButton" onclick="uploadSSH()">Upload</button>
-                    <button class="col keyButton" onclick="generateSSH('<?php echo $UserName; ?>', '<?php echo $UserId; ?>', '<?php echo $AuthToken; ?>')">Generate</button>
-                    <button class="col keyButton" onclick="uploadSSH('<?php echo $UserId; ?>', '<?php echo $AuthToken; ?>' )">Upload</button>
                     <button class="col keyButton debug" onclick="testSwal()">Test Popup</button>
                     <form id="uploadForm" enctype="multipart/form-data">
                         <input id="keyfile" type="file" style="display: none;"/>
                     </form>
                 </div>
-                <?php require("/var/www/usergen/footer.php"); ?>
+                <div class="row button">
+                    <button class="col keyButton" onclick="logout()">Log Out</button>
+                </div>
+                <?php require("/var/www/usergen/elements/footer.php"); ?>
             </div>
             <div class="desktopOnly col-4"></div>
         </div>

auth/setKey.php

@@ -2,6 +2,10 @@
 // Create an account and apply SSH key
 $config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
 
+require_once("/var/www/usergen/secret/helpers.php");
+require_once("/var/www/usergen/secret/oauth.php");
+require_once("/var/www/usergen/secret/rsa.php");
+
 function checkParameters($parameterArray){
     $error = false;
     foreach($parameterArray as $parameter){
@@ -18,12 +22,13 @@ function apiResult($result){
     exit();
 }
 
-function success(){
+function success($encryptedToken){
-    apiResult(array("status" => true));
+    $Auth = verifyEncToken($encryptedToken);
+    returnSuccess(true, buildEncToken($Auth["AuthToken"], $Auth["UserID"], $_SERVER["REMOTE_ADDR"], $_SERVER["HTTP_USER_AGENT"]));
 }
 
 function error($error){
-    apiResult(array("status" => false, "error" => $error));
+    returnError($error);
 }
 
 function validateUsername($username){
@@ -34,33 +39,30 @@ function validatePublicKey($key){
     return (preg_match("/^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/", $key) == 1);
 }
 
-if (checkParameters(array("pubkey", "userId", "authToken"))){
+if (checkParameters(array("pubkey", "token"))){
     error("Missing parameters");
 }
 
-$userToken = $_POST["authToken"];
+$userToken = $_POST["token"];
-$userId = $_POST["userId"];
 $pubkey = $_POST["pubkey"];
 
 if(!validatePublicKey($pubkey)){
     error("Invalid public key");
 }
 
-$request = curl_init();
+$User = verifyEncToken($userToken);
-curl_setopt($request, CURLOPT_URL, "https://hackers.town/api/v1/accounts/verify_credentials");
-curl_setopt($request, CURLOPT_RETURNTRANSFER, 1);
-curl_setopt($request, CURLOPT_HTTPHEADER, array(
-    "Authorization: Bearer ".$userToken
-));
-$response = curl_exec($request);
-curl_close($request);
-$User = json_decode($response);
 // Check User
-if($User->id != $userId){
+
-    error("User Mismatch");
+if (gettype($User) == "string") {
+    // Invalid Token
+    error($User);
+}else{
+    // Valid Token
+    $User = $User["MastodonData"];
 }
+
 if(!validateUsername($User->username)){
-    error("Invalid Username");
+    error("Invalid POSIX Username");
 }
 // Create temporary pubkey holding file
 $TempFileName = "/etc/ttyserver/tmp/".uniqid("ssh-", true).".pub";
@@ -68,11 +70,11 @@ if(!file_put_contents($TempFileName, $pubkey."\n")){
     error("Key Addition Failed: Temp");
 }
 // Run User Generation Tool
-// TODO: Replace with custom Rust PHP Extension
+// TODO: Replace with custom Rust PHP Extension?
 $UserGenCode = shell_exec("/usr/bin/sudo /etc/ttyserver/bin/mkuser \"".$User->username."\" \"".$TempFileName."\" 2>&1; echo $?");
 if($UserGenCode != "0"){
     error("Key Addition Failed: MK-".$UserGenCode);
 }
-success();
+success($userToken);
 
 ?>

elements/head.php

@@ -0,0 +1,16 @@
+<Head>
+    <Title>HackersTown Server Access</Title>
+    <meta charset="utf-8">
+    <base href="/auth"/>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <!-- Javascript -->
+    <script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
+    <script src="https://code.jquery.com/color/jquery.color.plus-names-2.1.2.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
+    <script src="https://cdn.jsdelivr.net/npm/jszip@3.9.1/dist/jszip.min.js" integrity="sha256-aSPPIlJfSHQ5T7wunbPcp7tM0rlq5dHoUGeN8O5odMg=" crossorigin="anonymous"></script>
+    <script src="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.all.min.js" crossorigin="anonymous"></script>
+    <script src="/fittext.js"></script>
+    <!-- Stylesheets -->
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
+    <link href="/style.css" rel="stylesheet"/>
+</Head>

elements/logo.php

@@ -0,0 +1,9 @@
+<div class="row">
+    <?php if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
+        echo "<a href=\"".file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE")."\">";
+    }else{
+        echo "<a href=\"https://tty.hackers.town\">";
+    }?>
+        <img src="/Assets/HTown.png" class="logo self-align-center mx-auto d-block" alt="Hacker Town logo in ASCII art. Rendered as image to force correct visualization."/>
+    </a>
+</div>

elements/oldError.php

@@ -0,0 +1,18 @@
+<!-- Error Display -->
+<div class="row"<?php if(strpos($AuthToken, "Bad") === false){
+    echo "hidden";
+}?>>
+    <span>
+        Invalid
+    </span>
+    <span>
+        try again
+    </span>
+    <div id="ErrorResult" class="message">
+        <?php echo $ErrorDesc; ?>
+    </div>
+</div><div class="row button"<?php if(strpos($AuthToken, "Bad") === false){
+    echo "hidden";
+}?>>
+    <button class="col keyButton" onclick="beginOauth()">Retry</button>
+</div>

elements/unauth.php

@@ -0,0 +1,8 @@
+<div id="title" class="row center">
+    <span id="resizer">
+        &ltTTY ACCESS&gt
+    </span>
+</div>
+<div class="row button">
+    <button id="bttn" class="keyButton" onclick="beginOauth()">Log In With HTown <!-- img src="/Assets/HTown.png" class="emoji"/ --></button>
+</div>

index.js

@@ -2,50 +2,15 @@ var DEBUG = false;
 var isMobile = false;
 var USE_ORIGIN = "";
 
-const dbp = (msg) => {
-  if(DEBUG){
-    console.log(msg);
-  }
-};
-
-const dbd = (msg) => {
-  if(DEBUG){
-    console.dir(msg);
-  }
-};
-
 const SwalConfig = {
   color: "#79F257",
   background: "#022601",
   buttonsStyling: false,
 }
 
-const invalidChars = [
-  '/', '\\', '>',
-  '<', ':', '*',
-  '|', '"', '\'',
-  '?', '\0'
-];
-
-const replaceInvalid = (str) => {
-  var cache = str;
-  invalidChars.forEach(ch => {
-    cache = cache.replaceAll(ch, "#");
-  });
-  return cache;
-}
-
 const isOverflown = ({ clientHeight, scrollHeight }) => scrollHeight > clientHeight
 
-const setCookie = (cname, cvalue, exdays) => {
-  const d = new Date();
-  d.setTime(d.getTime() + (exdays*24*60*60*1000));
-  let expires = "expires="+ d.toUTCString();
-  document.cookie = cname + "=" + cvalue + ";" + expires + ";SameSite=Strict;path=/auth";
-}
-
 const resizeText = ({ element, elements, minSize = 10, maxSize = 512, step = 1, unit = 'px' }) => {
-  dbp("Resize");
   (elements || [element]).forEach(el => {
     let i = minSize;
     let overflow = false;
@@ -60,19 +25,6 @@ const resizeText = ({ element, elements, minSize = 10, maxSize = 512, step = 1,
   });
 }
 
-const saveFile = (name, type, data) => {
-  if (data !== null && navigator.msSaveBlob)
-    return navigator.msSaveBlob(new Blob([data], { type: type }), name);
-  var a = $("<a style='display: none;'/>");
-  var url = window.URL.createObjectURL(new Blob([data], {type: type}));
-  a.attr("href", url);
-  a.attr("download", name);
-  $("body").append(a);
-  a[0].click();
-  window.URL.revokeObjectURL(url);
-  a.remove();
-}
-
 const disableNonDesktopElements = () => {
   var disableElements = document.getElementsByClassName("desktopOnly");
   for(var i=0; i< disableElements.length; i++){
@@ -94,140 +46,25 @@ const disableNonDesktopElements = () => {
 }
 
 const failMsg = (msg) => {
-  $("#resizer").html(msg);
-  $("#resizer").css("color", "#400112");
-  $("#resizer").css("background-color", "#79F257");
-  $("#resizer").animate({
-    color: "#79F257",
-    backgroundColor: "#022601"
-  }, 1000);
-}
-
-const validatePubKey = (key) => {
-  return /^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/.test(key);
-}
-
-const sendSSH = (key, id, token) => {
-  var payload = {
-    pubkey: key,
-    userId: id,
-    authToken: token
-  };
-  $.post(USE_ORIGIN+"/auth/setKey.php", payload, (response) => {
-    dbp(response);
-    if(response.status){
-      Swal.fire({
-        ...SwalConfig,
-        title: "Success!",
-        text: "Your key has been uploaded to the server."
-      }).then(()=>{
-        window.location.reload();
-      });
-    }else{
-      Swal.fire({
-        ...SwalConfig,
-        title: "Failed!",
-        text: response.error
-      }).then(()=>{
-        window.location.reload();
-      });
-    }
-  }).fail((resp) => {
-    dbp("Failed");
-    dbd(resp);
-    Swal.fire({
-      ...SwalConfig,
-      title: "Failed!",
-      text: resp.toString()
-    }).then(()=>{
-      window.location.reload();
-    });
-  });
-}
-
-const generateSSH = async (name, id, token) => {
-  dbp("Generate Key");
-  if (window.location.protocol === "http:") {
   Swal.fire({
     ...SwalConfig,
     title: "Error!",
-      text: "You must use HTTPS to generate keys."
+    text: msg,
   });
-    return;
-  }
-  generateKeyPair("RSASSA-PKCS1-v1_5", 4096, "WebGen " + Date())
-    .then((keys) => {
-      var KeyExport = new JSZip();
-      name = replaceInvalid(name);
-      KeyExport.file("HackersTownTTY-"+name, keys[0]);
-      KeyExport.file("HackersTownTTY-"+name+".pub", keys[1]);
-      KeyExport.generateAsync({type:"blob"})
-        .then((content) => {
-          saveFile("HackersTownTTY-"+name+".zip", "application/zip", content);
-      });
-      sendSSH(keys[1], id, token);
-    }).catch((err) => {
-      dbp(err);
-    });
-}
-
-const testSwal = () => {
-  Swal.fire({
-    ...SwalConfig,
-    title: "Success!",
-  });
-}
-
-const uploadSSH = (id, token) => {
-  //request local file
-  var kf = document.getElementById("keyfile");
-  kf.onchange = function(e) {
-    // File selected
-    var file = e.target.files[0];
-    if(file){
-      dbd(file);
-      var reader = new FileReader();
-      reader.readAsText(file, "UTF-8");
-      reader.onload = function (evt) {
-        var pubkey = evt.target.result;
-        pubkey = pubkey.replace(/\r\n/g, "\n");
-        dbp(pubkey);
-        pubkey = pubkey.replace(/\n/g, "");
-        dbp(pubkey);
-        if(validatePubKey(pubkey)){
-          sendSSH(pubkey, id, token);
-        }else{
-          failMsg("Invalid key");
-        }
-      }
-      reader.onerror = function (evt) {
-        failMsg("Unable to load Keyfile");
-      }
-
-    }
-  }
-  kf.click();
 }
 
 const beginOauth = () => {
-  dbp("Auth");
   $.ajax({
-    url: USE_ORIGIN+"/auth?act=id"
+    url: USE_ORIGIN+"/auth/api?act=id"
   }).then((data) => {
-    dbd(data);
     if(data.id){
       var redirect = "https://hackers.town/oauth/authorize?"+
         "response_type=code&client_id="+data.id+"&redirect_uri="+
         USE_ORIGIN+"/auth&scope=read:accounts";
-      dbp(redirect);
-      dbp(window.location.pathname);
-      if(window.location.pathname.includes("auth")){
-        setCookie("oa_retries", 0, 0.1);
-      }
       window.location.href = redirect;
     }else{
       // Auth Failed
-      failMsg("AUTH FAILED");
+      failMsg("Server ID Error");
     }
   });
 }
@@ -262,8 +99,9 @@ const displayFingerprints = () => {
 
 // On Page Load...
 $(() => {
-  dbp("Begin Init Content");
+  if (localStorage.getItem("tty_token")) {
-
+    window.location.href = "/auth";
+  }
   // Override domain
   $.get("/DOMAIN_OVERRIDE", function (data) {
       USE_ORIGIN = data.replaceAll("\n", "");
@@ -279,34 +117,28 @@ $(() => {
       }
       // Adjust for Mobile
       if(isMobile){
-      dbp("Is Mobile 👍🏻");
         disableNonDesktopElements();
       }
-
-    // Auto Retry
-    // TODO: Replace with redirect to home with logout set if error
-    var isRetry = false;
-    if(window.location.pathname.includes("auth")){
-      var ErrorMsg = document.getElementById("ErrorResult");
-      dbp(typeof ErrorMsg);
-      if(typeof ErrorMsg !== 'undefined' && ErrorMsg.innerText.includes("Retry")){
-        dbp("attempt retry");
-        isRetry = true;
-        beginOauth();
-      }
-    }
-
       // Console Welcome
-    if(!isRetry){
       console.log("%cWelcome Hacker!", "color: #ff0000; font-size: 7em; font-style: italic; font-family: 'Times New Roman', Times, serif;");
-    }
-
       // Enable Extra Debug Stuff
       if(DEBUG){
-      dbp("Debug Mode Enabled");
         $('.debug').each((i,e)=>{
           e.style.display = "unset";
         });
       }
+      var parameters = new URL(window.location.href).searchParams;
+      var message = parameters.get("msg");
+      var error = parameters.get("error");
+      if(error){
+        failMsg(error);
+      }
+      if(message){
+        Swal.fire({
+          ...SwalConfig,
+          text: message
+        });
+      }
+
     })
 });

index.php

@@ -2,56 +2,17 @@
 <!-- TODO: Add popup with error if passed to page -->
 <?php
     require_once("/var/www/usergen/secret/helpers.php");
-    if (isset($_REQUEST["act"])){
-        switch($_REQUEST["act"]){
-            case "logout":
-                // Logout
-                clearCookies();
-                break;
-            default:
-                break;
-        }
-    }
 ?>
 <HTML lang="en">
-    <Head>
+    <?php require("/var/www/usergen/elements/head.php"); ?>
-        <Title>HackersTown Server Access</Title>
-        <meta charset="utf-8">
-        <base href="/"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1">
-        <!-- Javascript -->
-        <script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
-        <script src="https://code.jquery.com/color/jquery.color.plus-names-2.1.2.min.js"></script>
-        <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
-        <script src="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.all.min.js" crossorigin="anonymous"></script>
-        <script src="/fittext.js"></script>
-        <script src="/index.js"></script>
-        <!-- Stylesheets -->
-        <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
-        <link href="/style.css" rel="stylesheet"/>
-    </Head>
     <Body>
+        <script src="/index.js"></script>
         <div class="row">
             <div class="desktopOnly col-4"></div>
             <div id="content" class="col-4 center">
-                <div class="row">
+                <?php require("/var/www/usergen/elements/logo.php"); ?>
-                    <?php if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
+                <?php require("/var/www/usergen/elements/unauth.php"); ?>
-                        echo "<a href=\"".str_replace("\n", "", file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE"))."\">";
+                <?php require("/var/www/usergen/elements/footer.php"); ?>
-                    }else{
-                        echo "<a href=\"https://hackers.town\">";
-                    }?>
-                        <img src="/Assets/HTown.png" class="logo self-align-center mx-auto d-block" alt="Hacker Town logo in ASCII art. Rendered as image to force correct visualization."/>
-                    </a>
-                </div>
-                <div id="title" class="row center">
-                    <span id="resizer">
-                        &ltTTY ACCESS&gt
-                    </span>
-                </div>
-                <div class="row button">
-                    <button id="bttn" class="keyButton" onclick="beginOauth()">Log In With HTown <!-- img src="/Assets/HTown.png" class="emoji"/ --></button>
-                </div>
-                <?php require("/var/www/usergen/footer.php"); ?>
             </div>
             <div class="desktopOnly col-4"></div>
         </div>

secret/helpers.php

@@ -19,4 +19,22 @@ function enableDebug(){
     ini_set('display_startup_errors', 1);
     error_reporting(E_ALL);
 }
+
+function returnError($error){
+    if (gettype($error) == "object") {
+        $error = json_encode($error);
+    }
+    header('Content-type: application/json');
+    echo json_encode(array("error" => $error));
+    exit();
+}
+
+function returnSuccess($success, $refreshToken = ""){
+    header('Content-type: application/json');
+    echo json_encode(array(
+        "data" => $success,
+        "refreshToken" => $refreshToken
+    ));
+    exit();
+}
 ?>

secret/oauth.php

@@ -10,13 +10,6 @@ function verifyCredentials($Auth) {
     $response = curl_exec($request);
     curl_close($request);
     $User = json_decode($response);
-
-    // if (isset($User->id)){
-    //     // Congrats!
-    //     $UserName = $User->display_name;
-    //     $UserId = $User->id;
-    // }else{
-    // }
     return (isset($User->error) ? $User->error : $User);
 }
 
@@ -41,4 +34,9 @@ function oauthToken($AuthCode, $config){
     $Auth = json_decode($response);
     return (isset($Auth->error) ? $Auth->error_description : $Auth);
 }
+
+function getHello() {
+    $Welcomes = array("Welcome", "Dobrodošli", "Vitejte", "Welkom", "Tervetuloa", "Willkommen", "Fáilte", "Benvenuto", "Bienvenidos", "Välkommen", "ようこそ");
+    return $Welcomes[array_rand($Welcomes)];
+}
 ?>

secret/rsa.php

@@ -38,6 +38,26 @@ function getFingerprint() {
     return $fingerprint;
 }
 
+// Object -> JSON -> Base84 -> Split -> Encrypt -> Combined -> re-base64 -> Sent
+
+function encryptPayload($input){
+    $holdingArray = str_split(base64_encode($input), 64);
+    $holdingArray = array_map(function($value){
+        return encrypt($value);
+    }, $holdingArray);
+    $holdingArray = implode("%", $holdingArray);
+    return $holdingArray;
+}
+
+function decryptPayload($input){
+    $holdingArray = explode("%", $input);
+    $holdingArray = array_map(function($value){
+        return decrypt($value);
+    }, $holdingArray);
+    $holdingArray = implode("", $holdingArray);
+    return base64_decode($holdingArray);
+}
+
 function encrypt($input){
     // Encrypt with public key
     ensureKey();
@@ -61,4 +81,56 @@ function decrypt($input){
     return $decrypted;
 }
 
+function buildEncToken($AuthToken, $UserID, $UserIP, $UserAgent ){
+    // Token Data:
+    //  - HTown AuthToken
+    //  - UserID
+    //  - UserIP
+    //  - UserAgent
+    //  - Timestamp
+    $TokenData = array(
+        "AuthToken" => $AuthToken,
+        "UserID" => $UserID,
+        "UserIP" => $UserIP,
+        "UserAgent" => $UserAgent,
+        "Timestamp" => time() // Unix Time in Seconds
+    );
+    $TokenData = json_encode($TokenData);
+    $EncTokenData = encryptPayload($TokenData);
+    return $EncTokenData;
+}
+
+function verifyEncToken($EncTokenData){
+    $TokenData = decryptPayload($EncTokenData);
+    $TokenData = json_decode($TokenData);
+    if ($TokenData != null && isset($TokenData->AuthToken) && isset($TokenData->UserID) && isset($TokenData->UserIP) && isset($TokenData->UserAgent) && isset($TokenData->Timestamp)) {
+        // Valid Token
+        if (time() - $TokenData->Timestamp > 900) { // 15-minute max login session
+            // Token Expired
+            return "Login Expired";
+        }
+        if ($TokenData->UserIP != $_SERVER["REMOTE_ADDR"]) {
+            // IP Mismatch
+            return "IP Mismatch";
+        }
+        if ($TokenData->UserAgent != $_SERVER["HTTP_USER_AGENT"]) {
+            // User Agent Mismatch
+            return "UserAgent Mismatch";
+        }
+        $credentialResults = verifyCredentials($TokenData->AuthToken);
+        if (gettype($credentialResults) == "string") {
+            // Invalid AuthToken
+            return "Invalid Mastodon Account";
+        }
+        return array(
+            "AuthToken" => $TokenData->AuthToken,
+            "UserID" => $TokenData->UserID,
+            "MastodonData" => $credentialResults
+        );
+    }else{
+        // Invalid Token
+        return "Invalid Token";
+    }
+}
+
 ?>

send.php

@@ -1,63 +0,0 @@
-<?php
-
-// echo exec('whoami');
-exit();
-$z=1/0;
-use Lrf141\OAuth2\Client\Provider\Mastodon;
-$config = json_decode(file_get_contents("config.json", true));
-
-session_start();
-
-$origin = "https://tty.hackers.town";
-if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
-    $origin = str_replace("\n", "", file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE"));
-}
-
-$provider = new Mastodon([
-    'clientId' => $config.oauth.key,
-    'clientSecret' => $config.oauth.secret,
-    'redirectUri' => $origin.'/auth',
-    'instance' => 'https://hackers.town',
-    'scope' => 'read:accounts',
-]);
-
-
-if (!isset($_GET['code'])) {
-
-    $authUrl = $provider->getAuthorizationUrl();
-
-    $_SESSION['oauth2state'] = $provider->getState();
-    header('Location: '.$authUrl);
-    exit;
-
-// Check given state against previously stored one to mitigate CSRF attack
-} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
-
-    unset($_SESSION['oauth2state']);
-    exit('Invalid state');
-
-} else {
-
-    // Try to get an access token (using the authorization code grant)
-    $token = $provider->getAccessToken('authorization_code', [
-        'code' => $_GET['code']
-    ]);
-
-    // Optional: Now you have a token you can look up a users profile data
-    try {
-
-        $user = $provider->getResourceOwner($token);
-
-        echo $user->getName();
-
-    } catch(Exception $e) {
-
-
-        exit('Oh dear...');
-    }
-
-
-    echo $token->getToken();
-}
-
-?>