117bb18 · 157f97b · 03ce905
@@ -363,6 +363,8 @@
The relying party is the address the browser used (or
`FORGE_URL`), so a passkey does not follow a forge to another hostname.
Sign-up is a username and a password of at least 12 characters (`/signup`, `POST /api/v1/users` with `{username, password, email?}`, the terminal), hashed with argon2id; the email is optional and, when given, gets the verify link (an account with none has nothing to prove). A passkey (`src/web/pages/signup-passkey.ts`, which does take an email) is offered beside the password. Nothing in the path touches an edge, parent or Forgejo account. An operator can still refuse password sign-ups with `passkeyOnlySignup`. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) takes the same: a username and a password with the email optional, or a passkey (which needs an email; challenges from `POST /claim/options`), and a claim with neither a long enough password nor a passkey is refused without spending the link. An admin's everyday account (`web/pages/everyday.ts`) still makes its account with a passkey only (`web/passkey-ceremony.ts`, challenges from `POST /settings/everyday/options`): it reads no password, and without JavaScript the page says a passkey needs it.
Password checks are bounded (`src/core/hash-gate.ts`): at most 4 argon2 verifications run at once, and a password over 1024 bytes is never hashed and cannot be set (sign-up, claim and change-password refuse it with "Use 1024 bytes or fewer."). A check over the cap is refused at once, not queued: the caller sees the same `throttled` answer as a full sign-in window (429 with `Retry-After: 1` on HTTP Basic, the API and the sign-in page, "try again" in the terminal; an over-long Basic password is a plain 401), and the attempt is given back to the sign-in windows. The 4-hash cap is a deliberate trade-off: an attacker who keeps 4 hashes busy can make real sign-ins get "try again in 1s"; the per-source sign-in window is what limits how long they can.
      
        junipercrew
        25d ago
        outdated
      
      "the same throttled answer ... 429 with Retry-After on the API" is not true for Basic auth. Make it true or say Basic answers 401.
    
A forge with a parent (`FORGE_PARENT_URL`, or the `upstream` in a spawned
forge's `parent.json`) lists the parent under "Link an account you have" on `/signin`. The forge
registers itself once at the parent's `/oauth/register` (the client id is kept
@@ -3,6 +3,7 @@
 * an account authenticates with over the SSH listener.
 */
import { withinPasswordCap } from "../core/hash-gate.ts";
import { emailChanged, welcome } from "./verify.ts";
import type { App } from "../app.ts";
import type { Credential } from "../auth/webauthn.ts";
@@ -126,6 +127,7 @@
export async function signUp(
  const email = (input.email ?? "").trim();
  if (email !== "" && !givenEmail(email)) return err("invalid_email");
  if (input.password.length < MIN_SIGNUP_PASSWORD) return err("weak_password");
  if (!withinPasswordCap(input.password)) return err("password_too_long");
  const secret = app.config.turnstileSecret;
  // The terminal cannot render a widget, so with a secret set it brings no
  // token and is refused, the forge's first account too: sign up on the web page.
@@ -316,7 +318,8 @@
export type ChangePasswordError =
  | "unauthorized"
  | "bad_credentials"
  | "throttled"
  | "weak_password";
  | "weak_password"
  | "password_too_long";
/** Replace the password; the current one must be presented and verified. */
export async function changePassword(
@@ -333,7 +336,12 @@
export async function changePassword(
  });
  if (!verified.ok) return err(verified.error.reason);
  const changed = await rehash(app.db, user.value.id, input.next);
  if (!changed.ok) return err(changed.error === "weak_password" ? "weak_password" : "unauthorized");
  if (!changed.ok)
    return err(
      changed.error === "weak_password" || changed.error === "password_too_long"
        ? changed.error
        : "unauthorized",
    );
  app.bus.append({
    kind: "user.updated",
    actorId: user.value.id,
@@ -0,0 +1,35 @@
/**
 * How many argon2 checks may run at once. Each one holds 64 MiB and a core,
 * and the sign-in windows count attempts per minute, not attempts in flight:
 * a burst of distinct accounts from many sources would still start them all
 * together. Past the cap an attempt is refused at once, not queued, so a
 * flood cannot pile up memory behind the hash. Passwords past `MAX_PASSWORD`
 * bytes are never hashed: no person types one, and the cost grows with length.
 */
export const MAX_CONCURRENT_HASHES = 4;
export const MAX_PASSWORD = 1024;
/** Seconds a refused caller is told to wait. */
export const GATE_RETRY_AFTER = 1;
/** What a person is told when a password they set is past the cap. */
export const PASSWORD_TOO_LONG = `Use ${MAX_PASSWORD} bytes or fewer.`;
/** Whether a password is within the cap, counted in bytes as it is hashed. */
export const withinPasswordCap = (password: string): boolean =>
  Buffer.byteLength(password) <= MAX_PASSWORD;
let running = 0;
/** Run `work` in a free slot, or return undefined when every slot is taken. */
export async function withHashSlot<T>(
  work: () => Promise<T>,
  cap: number = MAX_CONCURRENT_HASHES,
): Promise<T | undefined> {
  if (running >= cap) return undefined;
  running += 1;
  try {
    return await work();
  } finally {
    running -= 1;
  }
}
@@ -3,6 +3,7 @@
 * narrower; there is no second identity system.
 */
import { GATE_RETRY_AFTER, withinPasswordCap, withHashSlot } from "./hash-gate.ts";
import { markUnproven, markVerified } from "./verify.ts";
import type { Database } from "bun:sqlite";
import { isSafeName } from "../git/guard.ts";
@@ -88,6 +89,8 @@
export const isActive = (user: User): boolean =>
export const hiddenFrom = (user: User, viewer: User | undefined): boolean =>
  user.kind === "user" && !isActive(user) && viewer?.isAdmin !== true;
// The minimum counts characters, the cap (`hash-gate.ts`) counts bytes: the
// hash reads bytes, and a person never meets the difference at these sizes.
const MIN_PASSWORD = 10;
const MAX_EMAIL = 254;
const MAX_DISPLAY_NAME = 80;
@@ -98,6 +101,7 @@
export type CreateUserError =
  | "username_reserved"
  | "email_taken"
  | "weak_password"
  | "password_too_long"
  | "signup_closed";
/**
@@ -280,6 +284,8 @@
export async function createUser(
  const password = agent ? undefined : input.password;
  if (password !== undefined && password.length < MIN_PASSWORD)
    return err("weak_password");
  if (password !== undefined && !withinPasswordCap(password))
    return err("password_too_long");
  const existing = db
    .query<
@@ -423,8 +429,9 @@
export async function changePassword(
  db: Database,
  userId: string,
  next: string,
): Promise<Result<void, "weak_password" | "no_such_user">> {
): Promise<Result<void, "weak_password" | "password_too_long" | "no_such_user">> {
  if (next.length < MIN_PASSWORD) return err("weak_password");
  if (!withinPasswordCap(next)) return err("password_too_long");
  const hash = await Bun.password.hash(next, "argon2id");
  const changed = db
    .query("UPDATE user SET password_hash = ?1 WHERE id = ?2 AND kind = 'user'")
@@ -494,10 +501,19 @@
export async function verifyPasswordThrottled(
  db: Database,
  attempt: PasswordAttempt,
): Promise<Result<User, PasswordRefusal>> {
  if (!withinPasswordCap(attempt.password))
    return err({ reason: "bad_credentials" });
  const admission = admitSignin(db, attempt.username, attempt.source);
      
        junipercrew
        25d ago
        outdated
      
      The give-back and the 1s retryAfter on a full gate are untested. Add a test through verifyPasswordThrottled.
    
  if (!admission.admitted)
    return err({ reason: "throttled", retryAfter: admission.retryAfter });
  const checked = await checkPassword(db, attempt.username, attempt.password);
  const checked = await withHashSlot(() =>
    checkPassword(db, attempt.username, attempt.password),
  );
  if (checked === undefined) {
      
        junipercrew
        25d ago
        outdated
      
      This 429 only reaches the sign-in page and the API. HTTP Basic in src/http/server.ts drops it to a 401, so the bound is invisible there. Carry the retryAfter through, and test it.
    
    // Never hashed, so it is not a guess: give it back and ask for a moment.
    admission.succeeded();
    return err({ reason: "throttled", retryAfter: GATE_RETRY_AFTER });
  }
  if (!checked.ok) return err({ reason: "bad_credentials" });
  admission.succeeded();
  return checked;
@@ -21,6 +21,9 @@
export interface Auth {
  readonly sessionId?: string;
  /** Set for a proposal token: all it may do (`http/proposal_gate.ts`). */
  readonly proposal?: Proposal;
  /** Set when a Basic password was turned away by the sign-in windows or the
   * hash gate, not found wrong: the request answers 429, not 401. */
  readonly retryAfter?: number;
}
export interface Ctx {
@@ -494,6 +494,7 @@
import {
  notFound,
  prefersHtml,
  securityFloor,
  tooManyAttempts,
} from "./respond.ts";
import { compress } from "./compress.ts";
import { RateLimiter, type Verdict } from "../core/ratelimit.ts";
@@ -590,7 +591,7 @@
async function resolveAuth(app: App, request: Request): Promise<Auth> {
    }
    if (username !== "" && secret !== "") {
      // Counted in the sign-in windows like every password door; past them
      // the right password is refused too, so a guesser learns nothing.
      // the right password is refused too, with a 429 and Retry-After.
      const verified = await verifyPasswordThrottled(app.db, {
        username,
        password: secret,
@@ -598,6 +599,10 @@
async function resolveAuth(app: App, request: Request): Promise<Auth> {
      });
      if (verified.ok)
        return { user: verified.value, scope: "admin", via: "password" };
      // Not a wrong password: a git client or script must back off, not
      // read this as bad credentials.
      if (verified.error.reason === "throttled")
        return { ...NO_AUTH, retryAfter: verified.error.retryAfter };
    }
  }
  return NO_AUTH;
@@ -2422,6 +2427,7 @@
async function answerGet(
    return noRoute(request.method, url.pathname);
  }
  const auth = await resolveAuth(app, request);
  if (auth.retryAfter !== undefined) return tooManyAttempts(auth.retryAfter);
  noteUsage(request, { pattern: matched.pattern, role: roleOf(auth) });
  // From here a body's cap depends on who is asking (`http/limits.ts`), and
  // a stream this request opens is the account's, to end with it.
@@ -7,6 +7,7 @@
 * of them. Nothing here knows about repos or issues — that is the point.
 */
import { PASSWORD_TOO_LONG } from "../../core/hash-gate.ts";
import { refusalText } from "../../http/refusal.ts";
import { NOT_A_MEMBER } from "../../core/roles.ts";
import type { Ctx, Screen } from "../app/app.ts";
@@ -841,6 +842,7 @@
const MESSAGES: Record<string, string> = {
  key_exists: "that key is already registered",
  taken: "that name is taken",
  weak_password: "the password is too short (10 characters at least)",
  password_too_long: PASSWORD_TOO_LONG.toLowerCase().replace(/\.$/, ""),
  bad_credentials: "wrong username or password",
  throttled: "too many attempts: try again in a minute",
      
        sentinelcrew
        25d ago
        
      
      Low: the gate refuses with Retry-After 1s, but the terminal still says "try again in a minute" for every throttled. That is harmless but slightly wrong when the cause is the hash gate. If a later change touches this, word it without a duration, or carry retryAfter through to waitText the way the sign-up slot does.
    
  already_forked: "you already have a fork of this repo",
@@ -9,6 +9,7 @@
 * has been read once.
 */
import { PASSWORD_TOO_LONG } from "../../core/hash-gate.ts";
import { resendVerification } from "../../actions/verify.ts";
import { clientAddress } from "../../http/peer.ts";
import { emailVerified } from "../../core/verify.ts";
@@ -506,6 +507,8 @@
export async function passwordUpdate(ctx: Ctx): Promise<Response> {
              field: "current" as const,
              text: "Too many attempts. Try again in a minute.",
            }
          : changed.error === "password_too_long"
          ? { field: "next" as const, text: PASSWORD_TOO_LONG }
          : changed.error === "weak_password"
          ? {
              field: "next" as const,
@@ -18,6 +18,7 @@
 * so before anyone submits, and where to remove it.
 */
import { PASSWORD_TOO_LONG, withinPasswordCap } from "../../core/hash-gate.ts";
import { givenEmail, MIN_SIGNUP_PASSWORD, noEmail } from "../../actions/users.ts";
import type { Credential } from "../../auth/webauthn.ts";
import { crossOrigin, type Ctx } from "../../http/context.ts";
@@ -303,6 +304,7 @@
export async function claimSubmit(ctx: Ctx): Promise<Response> {
  const errors = problems(ctx, values.username, values.email.trim(), withKey);
  if (!withKey && password.length < MIN_SIGNUP_PASSWORD)
    errors.password = `Passwords need at least ${MIN_SIGNUP_PASSWORD} characters.`;
  else if (!withinPasswordCap(password)) errors.password = PASSWORD_TOO_LONG;
  if (Object.keys(errors).length > 0) return again(errors);
  // A key in the form is the passkey door; none is the password door.
  let credential: Credential | undefined;
@@ -8,6 +8,7 @@
 * typed still in it. A dead end that loses input is a bug, not a message.
 */
import { PASSWORD_TOO_LONG } from "../../core/hash-gate.ts";
import { NOT_A_MEMBER } from "../../core/roles.ts";
import { storageLimitMessage } from "../../core/storage.ts";
import { signOutHere } from "../../actions/signins.ts";
@@ -661,6 +662,7 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      username_taken: { username: "That username is taken." },
      username_reserved: { username: "That name is reserved." },
      email_taken: { email: "That email already has an account." },
      password_too_long: { password: PASSWORD_TOO_LONG },
      weak_password: { password: "Passwords need at least 12 characters." },
      invalid_email: { email: "That does not look like an email address." },
      human_check: { human: HUMAN_CHECK_MESSAGE },
@@ -229,6 +229,11 @@
describe("the claim link in the fragment, and its re-issue", () => {
    expect(weak.status).toBe(422);
    expect(await weak.text()).toContain("Passwords need at least 12 characters.");
    expect(getUserByName(child.db, "maria-owner")).toBeUndefined();
    // So is one past the hash cap, in words, also without spending the link.
    const long = await claim({ token: tokenOf(second), username: "maria-owner", password: "x".repeat(1025) });
    expect(long.status).toBe(422);
    expect(await long.text()).toContain("Use 1024 bytes or fewer.");
    expect(getUserByName(child.db, "maria-owner")).toBeUndefined();
    // A malformed address is refused on the password door, and so is a stand-in typed by hand.
    for (const email of ["not-an-address", "[email protected]"]) {
      const bad = await claim({ token: tokenOf(second), username: "maria-owner", email, password: PASSWORD });
@@ -0,0 +1,135 @@
/**
 * Password hashing is bounded (#3015): four argon2 checks at once, and no
 * password past 1024 bytes hashed or set. A full gate answers `throttled`
 * (429 with Retry-After on Basic, the API and the sign-in page) and gives the
 * attempt back to the sign-in windows; an over-long password is refused where
 * it is set, in words, on every surface that sets one.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { signUp, changePassword as changeOwnPassword } from "../src/actions/users.ts";
import { MAX_CONCURRENT_HASHES, MAX_PASSWORD, withHashSlot } from "../src/core/hash-gate.ts";
import { admitSignin } from "../src/core/signin-window.ts";
import { changePassword, createUser, getUserById, verifyPasswordThrottled } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
const LONG = "x".repeat(MAX_PASSWORD + 1);
const GOOD = "a-good-passphrase";
/** Hold every hash slot until the returned function is called. */
function fillGate(): () => Promise<void> {
  let release!: () => void;
  const held = new Promise<void>((r) => (release = r));
  const holders = Array.from({ length: MAX_CONCURRENT_HASHES }, () => withHashSlot(() => held));
  return async () => {
    release();
      
        junipercrew
        25d ago
        outdated
      
      Imports belong at the top of the file. Move these up and fold the two describe blocks together.
    
    await Promise.all(holders);
  };
}
test("slots beyond the cap are refused at once, and freed after", async () => {
  let release!: () => void;
  const held = new Promise<void>((r) => (release = r));
  const first = withHashSlot(() => held.then(() => 1), 1);
  expect(await withHashSlot(async () => 2, 1)).toBeUndefined();
  release();
  expect(await first).toBe(1);
  expect(await withHashSlot(async () => 3, 1)).toBe(3);
});
test("a slot is freed when the work throws", async () => {
  await withHashSlot(async () => {
    throw new Error("x");
  }, 1).catch(() => {});
  expect(await withHashSlot(async () => 4, 1)).toBe(4);
});
describe("the gate and the cap on a forge", () => {
  let dir: string;
  let app: App;
  let servers: Servers;
  let ginaId: string;
  const basic = (user: string, password: string) =>
    fetch(`${servers.url}/api/v1/user`, {
      headers: { authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}` },
    });
  const form = (path: string, fields: Record<string, string>) =>
    fetch(`${servers.url}${path}`, {
      method: "POST",
      headers: { origin: servers.url },
      body: new URLSearchParams(fields),
      redirect: "manual",
    });
  beforeAll(async () => {
    dir = await mkdtemp(join(tmpdir(), "forge-gate-"));
    app = createApp({ dataDir: dir, port: 0 });
    servers = await serve(app);
    const made = await createUser(app.db, { origin: "seed", trusted: true,
      username: "gina", email: "[email protected]", password: GOOD, adminIfFirst: true });
    if (!made.ok) throw new Error(made.error);
    ginaId = made.value.id;
  });
  afterAll(async () => {
    await servers.stop?.();
    await rm(dir, { recursive: true, force: true });
  });
  test("a full gate answers throttled with 1s and gives the window attempt back", async () => {
    const release = fillGate();
    const attempt = { username: "gina", password: GOOD, source: "10.0.0.9" };
    // Far more tries than the per-account window (20/min) allows: each is
    // refused by the gate, so none may be counted against it.
    for (let i = 0; i < 40; i++) {
      const out = await verifyPasswordThrottled(app.db, attempt);
      expect(out.ok).toBe(false);
      if (!out.ok) expect(out.error).toEqual({ reason: "throttled", retryAfter: 1 });
    }
    await release();
    expect(admitSignin(app.db, "gina", "10.0.0.9").admitted).toBe(true);
    expect((await verifyPasswordThrottled(app.db, attempt)).ok).toBe(true);
  });
  test("Basic with the gate full is 429 with Retry-After, not a 401", async () => {
    const release = fillGate();
    const res = await basic("gina", GOOD);
    await release();
    expect(res.status).toBe(429);
    expect(res.headers.get("retry-after")).toBe("1");
    expect((await basic("gina", GOOD)).status).toBe(200);
  });
  test("Basic with a password past the cap is a plain 401", async () => {
    const res = await basic("gina", LONG);
    expect(res.status).toBe(401);
    expect(res.headers.get("retry-after")).toBeNull();
  });
  test("a password past the cap is refused where it is set", async () => {
    const made = await createUser(app.db, { origin: "seed", trusted: true,
      username: "long", email: "[email protected]", password: LONG });
    expect(made.ok ? "ok" : made.error).toBe("password_too_long");
    const changed = await changePassword(app.db, ginaId, LONG);
    expect(changed.ok ? "ok" : changed.error).toBe("password_too_long");
  });
  test("sign-up and the own-password change refuse it too", async () => {
    const signed = await signUp(app, { username: "lena", password: LONG }, { slot: { admitted: true } as never });
    expect(signed.ok ? "ok" : signed.error).toBe("password_too_long");
    const changed = await changeOwnPassword(
      app,
      getUserById(app.db, ginaId),
      { current: GOOD, next: LONG, source: "10.0.0.8" },
    );
    expect(changed.ok ? "ok" : changed.error).toBe("password_too_long");
  });
  test("the sign-up page says so in words", async () => {
    const res = await form("/signup", { username: "mila", password: LONG });
    expect(res.status).toBe(422);
    expect(await res.text()).toContain("Use 1024 bytes or fewer.");
  });
});
@@ -67,7 +67,11 @@
describe("password doors share the sign-in windows", () => {
  test("HTTP Basic with a password refuses the right password after the window fills", async () => {
    const { url } = await forge();
    for (let i = 0; i < TRIES; i++) expect((await basic(url, `wrong-${i}`)).status).toBe(401);
    expect((await basic(url, PASSWORD)).status).toBe(401);
    // Past the window even the right password is turned away, as a 429 with
    // Retry-After, the answer every other password door gives.
    const refused = await basic(url, PASSWORD);
    expect(refused.status).toBe(429);
    expect(Number(refused.headers.get("retry-after"))).toBeGreaterThan(0);
  });
  test("a right password is given back: git sending it on every request is not throttled", async () => {
		@@ -363,6 +363,8 @@ The relying party is the address the browser used (or
363	363	`FORGE_URL`), so a passkey does not follow a forge to another hostname.
364	364	Sign-up is a username and a password of at least 12 characters (`/signup`, `POST /api/v1/users` with `{username, password, email?}`, the terminal), hashed with argon2id; the email is optional and, when given, gets the verify link (an account with none has nothing to prove). A passkey (`src/web/pages/signup-passkey.ts`, which does take an email) is offered beside the password. Nothing in the path touches an edge, parent or Forgejo account. An operator can still refuse password sign-ups with `passkeyOnlySignup`. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) takes the same: a username and a password with the email optional, or a passkey (which needs an email; challenges from `POST /claim/options`), and a claim with neither a long enough password nor a passkey is refused without spending the link. An admin's everyday account (`web/pages/everyday.ts`) still makes its account with a passkey only (`web/passkey-ceremony.ts`, challenges from `POST /settings/everyday/options`): it reads no password, and without JavaScript the page says a passkey needs it.
365	365
	366	Password checks are bounded (`src/core/hash-gate.ts`): at most 4 argon2 verifications run at once, and a password over 1024 bytes is never hashed and cannot be set (sign-up, claim and change-password refuse it with "Use 1024 bytes or fewer."). A check over the cap is refused at once, not queued: the caller sees the same `throttled` answer as a full sign-in window (429 with `Retry-After: 1` on HTTP Basic, the API and the sign-in page, "try again" in the terminal; an over-long Basic password is a plain 401), and the attempt is given back to the sign-in windows. The 4-hash cap is a deliberate trade-off: an attacker who keeps 4 hashes busy can make real sign-ins get "try again in 1s"; the per-source sign-in window is what limits how long they can.
		junipercrew 25d ago outdated "the same throttled answer ... 429 with Retry-After on the API" is not true for Basic auth. Make it true or say Basic answers 401.
	367
366	368	A forge with a parent (`FORGE_PARENT_URL`, or the `upstream` in a spawned
367	369	forge's `parent.json`) lists the parent under "Link an account you have" on `/signin`. The forge
368	370	registers itself once at the parent's `/oauth/register` (the client id is kept
		@@ -3,6 +3,7 @@
3	3	* an account authenticates with over the SSH listener.
4	4	*/
5	5
	6	import { withinPasswordCap } from "../core/hash-gate.ts";
6	7	import { emailChanged, welcome } from "./verify.ts";
7	8	import type { App } from "../app.ts";
8	9	import type { Credential } from "../auth/webauthn.ts";
		@@ -126,6 +127,7 @@ export async function signUp(
126	127	const email = (input.email ?? "").trim();
127	128	if (email !== "" && !givenEmail(email)) return err("invalid_email");
128	129	if (input.password.length < MIN_SIGNUP_PASSWORD) return err("weak_password");
	130	if (!withinPasswordCap(input.password)) return err("password_too_long");
129	131	const secret = app.config.turnstileSecret;
130	132	// The terminal cannot render a widget, so with a secret set it brings no
131	133	// token and is refused, the forge's first account too: sign up on the web page.
		@@ -316,7 +318,8 @@ export type ChangePasswordError =
316	318	\| "unauthorized"
317	319	\| "bad_credentials"
318	320	\| "throttled"
319		\| "weak_password";
	321	\| "weak_password"
	322	\| "password_too_long";
320	323
321	324	/** Replace the password; the current one must be presented and verified. */
322	325	export async function changePassword(
		@@ -333,7 +336,12 @@ export async function changePassword(
333	336	});
334	337	if (!verified.ok) return err(verified.error.reason);
335	338	const changed = await rehash(app.db, user.value.id, input.next);
336		if (!changed.ok) return err(changed.error === "weak_password" ? "weak_password" : "unauthorized");
	339	if (!changed.ok)
	340	return err(
	341	changed.error === "weak_password" \|\| changed.error === "password_too_long"
	342	? changed.error
	343	: "unauthorized",
	344	);
337	345	app.bus.append({
338	346	kind: "user.updated",
339	347	actorId: user.value.id,
		@@ -0,0 +1,35 @@
	1	/**
	2	* How many argon2 checks may run at once. Each one holds 64 MiB and a core,
	3	* and the sign-in windows count attempts per minute, not attempts in flight:
	4	* a burst of distinct accounts from many sources would still start them all
	5	* together. Past the cap an attempt is refused at once, not queued, so a
	6	* flood cannot pile up memory behind the hash. Passwords past `MAX_PASSWORD`
	7	* bytes are never hashed: no person types one, and the cost grows with length.
	8	*/
	9
	10	export const MAX_CONCURRENT_HASHES = 4;
	11	export const MAX_PASSWORD = 1024;
	12	/** Seconds a refused caller is told to wait. */
	13	export const GATE_RETRY_AFTER = 1;
	14	/** What a person is told when a password they set is past the cap. */
	15	export const PASSWORD_TOO_LONG = `Use ${MAX_PASSWORD} bytes or fewer.`;
	16
	17	/** Whether a password is within the cap, counted in bytes as it is hashed. */
	18	export const withinPasswordCap = (password: string): boolean =>
	19	Buffer.byteLength(password) <= MAX_PASSWORD;
	20
	21	let running = 0;
	22
	23	/** Run `work` in a free slot, or return undefined when every slot is taken. */
	24	export async function withHashSlot<T>(
	25	work: () => Promise<T>,
	26	cap: number = MAX_CONCURRENT_HASHES,
	27	): Promise<T \| undefined> {
	28	if (running >= cap) return undefined;
	29	running += 1;
	30	try {
	31	return await work();
	32	} finally {
	33	running -= 1;
	34	}
	35	}
		@@ -3,6 +3,7 @@
3	3	* narrower; there is no second identity system.
4	4	*/
5	5
	6	import { GATE_RETRY_AFTER, withinPasswordCap, withHashSlot } from "./hash-gate.ts";
6	7	import { markUnproven, markVerified } from "./verify.ts";
7	8	import type { Database } from "bun:sqlite";
8	9	import { isSafeName } from "../git/guard.ts";
		@@ -88,6 +89,8 @@ export const isActive = (user: User): boolean =>
88	89	export const hiddenFrom = (user: User, viewer: User \| undefined): boolean =>
89	90	user.kind === "user" && !isActive(user) && viewer?.isAdmin !== true;
90	91
	92	// The minimum counts characters, the cap (`hash-gate.ts`) counts bytes: the
	93	// hash reads bytes, and a person never meets the difference at these sizes.
91	94	const MIN_PASSWORD = 10;
92	95	const MAX_EMAIL = 254;
93	96	const MAX_DISPLAY_NAME = 80;
		@@ -98,6 +101,7 @@ export type CreateUserError =
98	101	\| "username_reserved"
99	102	\| "email_taken"
100	103	\| "weak_password"
	104	\| "password_too_long"
101	105	\| "signup_closed";
102	106
103	107	/**
		@@ -280,6 +284,8 @@ export async function createUser(
280	284	const password = agent ? undefined : input.password;
281	285	if (password !== undefined && password.length < MIN_PASSWORD)
282	286	return err("weak_password");
	287	if (password !== undefined && !withinPasswordCap(password))
	288	return err("password_too_long");
283	289
284	290	const existing = db
285	291	.query<
		@@ -423,8 +429,9 @@ export async function changePassword(
423	429	db: Database,
424	430	userId: string,
425	431	next: string,
426		): Promise<Result<void, "weak_password" \| "no_such_user">> {
	432	): Promise<Result<void, "weak_password" \| "password_too_long" \| "no_such_user">> {
427	433	if (next.length < MIN_PASSWORD) return err("weak_password");
	434	if (!withinPasswordCap(next)) return err("password_too_long");
428	435	const hash = await Bun.password.hash(next, "argon2id");
429	436	const changed = db
430	437	.query("UPDATE user SET password_hash = ?1 WHERE id = ?2 AND kind = 'user'")
		@@ -494,10 +501,19 @@ export async function verifyPasswordThrottled(
494	501	db: Database,
495	502	attempt: PasswordAttempt,
496	503	): Promise<Result<User, PasswordRefusal>> {
	504	if (!withinPasswordCap(attempt.password))
	505	return err({ reason: "bad_credentials" });
497	506	const admission = admitSignin(db, attempt.username, attempt.source);
		junipercrew 25d ago outdated The give-back and the 1s retryAfter on a full gate are untested. Add a test through `verifyPasswordThrottled`.
498	507	if (!admission.admitted)
499	508	return err({ reason: "throttled", retryAfter: admission.retryAfter });
500		const checked = await checkPassword(db, attempt.username, attempt.password);
	509	const checked = await withHashSlot(() =>
	510	checkPassword(db, attempt.username, attempt.password),
	511	);
	512	if (checked === undefined) {
		junipercrew 25d ago outdated This 429 only reaches the sign-in page and the API. HTTP Basic in src/http/server.ts drops it to a 401, so the bound is invisible there. Carry the retryAfter through, and test it.
	513	// Never hashed, so it is not a guess: give it back and ask for a moment.
	514	admission.succeeded();
	515	return err({ reason: "throttled", retryAfter: GATE_RETRY_AFTER });
	516	}
501	517	if (!checked.ok) return err({ reason: "bad_credentials" });
502	518	admission.succeeded();
503	519	return checked;
		@@ -21,6 +21,9 @@ export interface Auth {
21	21	readonly sessionId?: string;
22	22	/** Set for a proposal token: all it may do (`http/proposal_gate.ts`). */
23	23	readonly proposal?: Proposal;
	24	/** Set when a Basic password was turned away by the sign-in windows or the
	25	* hash gate, not found wrong: the request answers 429, not 401. */
	26	readonly retryAfter?: number;
24	27	}
25	28
26	29	export interface Ctx {
		@@ -494,6 +494,7 @@ import {
494	494	notFound,
495	495	prefersHtml,
496	496	securityFloor,
	497	tooManyAttempts,
497	498	} from "./respond.ts";
498	499	import { compress } from "./compress.ts";
499	500	import { RateLimiter, type Verdict } from "../core/ratelimit.ts";
		@@ -590,7 +591,7 @@ async function resolveAuth(app: App, request: Request): Promise<Auth> {
590	591	}
591	592	if (username !== "" && secret !== "") {
592	593	// Counted in the sign-in windows like every password door; past them
593		// the right password is refused too, so a guesser learns nothing.
	594	// the right password is refused too, with a 429 and Retry-After.
594	595	const verified = await verifyPasswordThrottled(app.db, {
595	596	username,
596	597	password: secret,
		@@ -598,6 +599,10 @@ async function resolveAuth(app: App, request: Request): Promise<Auth> {
598	599	});
599	600	if (verified.ok)
600	601	return { user: verified.value, scope: "admin", via: "password" };
	602	// Not a wrong password: a git client or script must back off, not
	603	// read this as bad credentials.
	604	if (verified.error.reason === "throttled")
	605	return { ...NO_AUTH, retryAfter: verified.error.retryAfter };
601	606	}
602	607	}
603	608	return NO_AUTH;
		@@ -2422,6 +2427,7 @@ async function answerGet(
2422	2427	return noRoute(request.method, url.pathname);
2423	2428	}
2424	2429	const auth = await resolveAuth(app, request);
	2430	if (auth.retryAfter !== undefined) return tooManyAttempts(auth.retryAfter);
2425	2431	noteUsage(request, { pattern: matched.pattern, role: roleOf(auth) });
2426	2432	// From here a body's cap depends on who is asking (`http/limits.ts`), and
2427	2433	// a stream this request opens is the account's, to end with it.
		@@ -7,6 +7,7 @@
7	7	* of them. Nothing here knows about repos or issues — that is the point.
8	8	*/
9	9
	10	import { PASSWORD_TOO_LONG } from "../../core/hash-gate.ts";
10	11	import { refusalText } from "../../http/refusal.ts";
11	12	import { NOT_A_MEMBER } from "../../core/roles.ts";
12	13	import type { Ctx, Screen } from "../app/app.ts";
		@@ -841,6 +842,7 @@ const MESSAGES: Record<string, string> = {
841	842	key_exists: "that key is already registered",
842	843	taken: "that name is taken",
843	844	weak_password: "the password is too short (10 characters at least)",
	845	password_too_long: PASSWORD_TOO_LONG.toLowerCase().replace(/\.$/, ""),
844	846	bad_credentials: "wrong username or password",
845	847	throttled: "too many attempts: try again in a minute",
		sentinelcrew 25d ago Low: the gate refuses with Retry-After 1s, but the terminal still says "try again in a minute" for every `throttled`. That is harmless but slightly wrong when the cause is the hash gate. If a later change touches this, word it without a duration, or carry `retryAfter` through to `waitText` the way the sign-up slot does.
846	848	already_forked: "you already have a fork of this repo",
		@@ -9,6 +9,7 @@
9	9	* has been read once.
10	10	*/
11	11
	12	import { PASSWORD_TOO_LONG } from "../../core/hash-gate.ts";
12	13	import { resendVerification } from "../../actions/verify.ts";
13	14	import { clientAddress } from "../../http/peer.ts";
14	15	import { emailVerified } from "../../core/verify.ts";
		@@ -506,6 +507,8 @@ export async function passwordUpdate(ctx: Ctx): Promise<Response> {
506	507	field: "current" as const,
507	508	text: "Too many attempts. Try again in a minute.",
508	509	}
	510	: changed.error === "password_too_long"
	511	? { field: "next" as const, text: PASSWORD_TOO_LONG }
509	512	: changed.error === "weak_password"
510	513	? {
511	514	field: "next" as const,
		@@ -18,6 +18,7 @@
18	18	* so before anyone submits, and where to remove it.
19	19	*/
20	20
	21	import { PASSWORD_TOO_LONG, withinPasswordCap } from "../../core/hash-gate.ts";
21	22	import { givenEmail, MIN_SIGNUP_PASSWORD, noEmail } from "../../actions/users.ts";
22	23	import type { Credential } from "../../auth/webauthn.ts";
23	24	import { crossOrigin, type Ctx } from "../../http/context.ts";
		@@ -303,6 +304,7 @@ export async function claimSubmit(ctx: Ctx): Promise<Response> {
303	304	const errors = problems(ctx, values.username, values.email.trim(), withKey);
304	305	if (!withKey && password.length < MIN_SIGNUP_PASSWORD)
305	306	errors.password = `Passwords need at least ${MIN_SIGNUP_PASSWORD} characters.`;
	307	else if (!withinPasswordCap(password)) errors.password = PASSWORD_TOO_LONG;
306	308	if (Object.keys(errors).length > 0) return again(errors);
307	309	// A key in the form is the passkey door; none is the password door.
308	310	let credential: Credential \| undefined;
		@@ -8,6 +8,7 @@
8	8	* typed still in it. A dead end that loses input is a bug, not a message.
9	9	*/
10	10
	11	import { PASSWORD_TOO_LONG } from "../../core/hash-gate.ts";
11	12	import { NOT_A_MEMBER } from "../../core/roles.ts";
12	13	import { storageLimitMessage } from "../../core/storage.ts";
13	14	import { signOutHere } from "../../actions/signins.ts";
		@@ -661,6 +662,7 @@ export async function signupSubmit(ctx: Ctx): Promise<Response> {
661	662	username_taken: { username: "That username is taken." },
662	663	username_reserved: { username: "That name is reserved." },
663	664	email_taken: { email: "That email already has an account." },
	665	password_too_long: { password: PASSWORD_TOO_LONG },
664	666	weak_password: { password: "Passwords need at least 12 characters." },
665	667	invalid_email: { email: "That does not look like an email address." },
666	668	human_check: { human: HUMAN_CHECK_MESSAGE },