pin on backend

Author: Emeteil

robot_orchestrator/paths.py

@@ -41,6 +41,10 @@ def generated_secrets_file(self) -> Path:
     def admin_file(self) -> Path:
         return self.secrets_dir / "admin.json"
 
+    @property
+    def settings_pin_file(self) -> Path:
+        return self.secrets_dir / "settings_pin.json"
+
     @property
     def repos_dir(self) -> Path:
         return self.state_dir / "repos"

robot_orchestrator/web/app.py

@@ -13,6 +13,7 @@
 from robot_orchestrator.paths import Paths
 from robot_orchestrator.web import auth, routes_api, routes_sse
 from robot_orchestrator.web.context import AdminContext
+from robot_orchestrator.web.settings_pin import PinError, PinInvalid, PinLocked, SettingsPin
 
 LOOPBACK_HOSTS = ("127.0.0.1", "::1", "localhost")
 STATIC_DIR = Path(__file__).resolve().parent / "static"
@@ -23,6 +24,15 @@ class LoginRequest(BaseModel):
     password: str
 
 
+class PinRequest(BaseModel):
+    pin: str | None = None
+
+
+class PinChangeRequest(BaseModel):
+    current: str | None = None
+    new: str
+
+
 class LoginResponse(BaseModel):
     access_token: str
     expires_in: int
@@ -98,6 +108,7 @@ def create_app(
 ) -> FastAPI:
     app = FastAPI()
     throttle = auth.LoginThrottle()
+    settings_pin = SettingsPin(paths)
     bearer = HTTPBearer(auto_error=False)
 
     def require_auth(
@@ -157,16 +168,60 @@ def boot_state(request: Request):
             "operator_url": context.operator_url,
         }
 
-    @app.post("/boot/api/session", include_in_schema=False)
-    def boot_session(request: Request):
+    def settings_guard(request: Request) -> None:
         require_loopback(request)
         # a tunnel or reverse proxy ends up as a loopback peer too, but it always adds forwarding headers
         if any(h in request.headers for h in ("x-forwarded-for", "forwarded", "x-real-ip")):
             raise HTTPException(status_code=403, detail="direct loopback only")
         if not (context and context.boot_progress and context.boot_progress.finished_at):
             raise HTTPException(status_code=409, detail="boot is not finished yet")
-        token = auth.issue_token(jwt_secret, "boot-settings", jwt_ttl_s)
-        return {"access_token": token, "expires_in": jwt_ttl_s}
+
+    def settings_token() -> dict:
+        return {"access_token": auth.issue_token(jwt_secret, "boot-settings", jwt_ttl_s), "expires_in": jwt_ttl_s}
+
+    def check_pin(pin: str | None) -> None:
+        try:
+            settings_pin.verify(pin or "")
+        except PinLocked as e:
+            raise HTTPException(
+                status_code=429, detail={"message": "too many attempts", "retry_after": int(e.retry_after) + 1}
+            )
+        except PinInvalid as e:
+            raise HTTPException(status_code=401, detail={"message": "wrong pin", "attempts_left": e.attempts_left})
+
+    @app.get("/boot/api/pin", include_in_schema=False)
+    def boot_pin_status(request: Request):
+        settings_guard(request)
+        return {"set": settings_pin.is_set(), "locked_for": int(settings_pin.locked_for())}
+
+    @app.post("/boot/api/pin/setup", include_in_schema=False)
+    def boot_pin_setup(body: PinRequest, request: Request):
+        settings_guard(request)
+        if settings_pin.is_set():
+            raise HTTPException(status_code=409, detail="pin is already set")
+        try:
+            settings_pin.set(body.pin)
+        except PinError as e:
+            raise HTTPException(status_code=400, detail=str(e))
+        return settings_token()
+
+    @app.post("/boot/api/pin/change", include_in_schema=False)
+    def boot_pin_change(body: PinChangeRequest, request: Request):
+        settings_guard(request)
+        check_pin(body.current)
+        try:
+            settings_pin.set(body.new)
+        except PinError as e:
+            raise HTTPException(status_code=400, detail=str(e))
+        return settings_token()
+
+    @app.post("/boot/api/session", include_in_schema=False)
+    def boot_session(body: PinRequest, request: Request):
+        settings_guard(request)
+        if not settings_pin.is_set():
+            raise HTTPException(status_code=409, detail="pin is not set")
+        check_pin(body.pin)
+        return settings_token()
 
     @app.get("/boot/api/stream", include_in_schema=False)
     async def boot_stream(request: Request):

robot_orchestrator/web/settings_pin.py

@@ -0,0 +1,86 @@
+import json
+import re
+import threading
+import time
+
+from robot_orchestrator.paths import Paths
+from robot_orchestrator.wal.atomic import atomic_write
+from robot_orchestrator.web.auth import hash_password, verify_password_hash
+
+MAX_FAILURES = 5
+LOCKOUT_S = 30.0
+_FORMAT = re.compile(r"^\d{4}$")
+
+
+class PinError(Exception):
+    pass
+
+
+class PinLocked(PinError):
+    def __init__(self, retry_after: float):
+        super().__init__("too many attempts")
+        self.retry_after = retry_after
+
+
+class PinInvalid(PinError):
+    def __init__(self, attempts_left: int):
+        super().__init__("wrong pin")
+        self.attempts_left = attempts_left
+
+
+class SettingsPin:
+    """The 4-digit PIN guarding the settings modal on the robot's own screen.
+
+    It lives next to the other secrets so it survives power loss; the kiosk browser's
+    profile is on tmpfs and cannot hold it.
+    """
+
+    def __init__(self, paths: Paths, clock=time.monotonic):
+        self._path = paths.settings_pin_file
+        self._clock = clock
+        self._lock = threading.Lock()
+        self._failures = 0
+        self._locked_until = 0.0
+
+    def is_set(self) -> bool:
+        return self._path.exists()
+
+    def locked_for(self) -> float:
+        with self._lock:
+            return max(0.0, self._locked_until - self._clock())
+
+    def set(self, pin: str) -> None:
+        if not _FORMAT.match(pin or ""):
+            raise PinError("pin must be 4 digits")
+        salt, digest = hash_password(pin)
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write(self._path, json.dumps({"salt_hex": salt.hex(), "hash_hex": digest.hex()}).encode("utf-8"))
+        with self._lock:
+            self._failures = 0
+            self._locked_until = 0.0
+
+    def verify(self, pin: str) -> None:
+        """Returns normally on a correct PIN, raises PinLocked / PinInvalid otherwise."""
+        with self._lock:
+            now = self._clock()
+            if self._locked_until > now:
+                raise PinLocked(self._locked_until - now)
+            record = self._load()
+            ok = bool(record) and isinstance(pin, str) and verify_password_hash(
+                pin, bytes.fromhex(record["salt_hex"]), bytes.fromhex(record["hash_hex"])
+            )
+            if ok:
+                self._failures = 0
+                return
+            self._failures += 1
+            if self._failures >= MAX_FAILURES:
+                self._failures = 0
+                self._locked_until = now + LOCKOUT_S
+                raise PinLocked(LOCKOUT_S)
+            raise PinInvalid(MAX_FAILURES - self._failures)
+
+    def _load(self) -> dict | None:
+        try:
+            return json.loads(self._path.read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            return None

robot_orchestrator/web/static/boot/index.html

@@ -790,7 +790,6 @@ <h2 id="pin-title">Введите PIN</h2>
   const $ = (id) => document.getElementById(id);
   const gear = $("gear-btn"), modal = $("settings"), pinBox = $("m-pin"), mainBox = $("m-main");
   const tabsEl = $("m-tabs"), content = $("m-content"), oskEl = $("osk");
-  const PIN_KEY = "supervisor.pin";
   const IDLE_MS = 120000;
 
   function h(tag, props, ...children) {
@@ -805,27 +804,20 @@ <h2 id="pin-title">Введите PIN</h2>
     return el;
   }
 
-  /* ---------------- PIN storage (browser-local, on purpose) ---------------- */
-  function storeGet() { try { return JSON.parse(localStorage.getItem(PIN_KEY) || "null"); } catch (e) { return null; } }
-  function storeSet(v) { try { localStorage.setItem(PIN_KEY, JSON.stringify(v)); return true; } catch (e) { return false; } }
-  async function hashPin(pin, salt) {
-    const data = new TextEncoder().encode(salt + ":" + pin);
-    if (window.crypto && crypto.subtle) {
-      const buf = await crypto.subtle.digest("SHA-256", data);
-      return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    }
-    let x = 5381;
-    for (const b of data) x = ((x * 33) ^ b) >>> 0;
-    return "d" + x.toString(16);
-  }
-
   /* ---------------- session / api ---------------- */
-  let token = null, tokenAt = 0;
+  let token = null, tokenAt = 0, sessionPin = null;
+  async function pinCall(path, body) {
+    const r = await fetch(path, { method: body === undefined ? "GET" : "POST", cache: "no-store",
+      headers: { "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body) });
+    let data = {};
+    try { data = await r.json(); } catch (e) { /* empty body */ }
+    return { status: r.status, data };
+  }
   async function ensureToken(force) {
     if (!force && token && Date.now() - tokenAt < 8 * 60 * 1000) return token;
-    const r = await fetch("/boot/api/session", { method: "POST" });
-    if (!r.ok) throw new Error("нет доступа к настройкам (" + r.status + ")");
-    token = (await r.json()).access_token;
+    const r = await pinCall("/boot/api/session", { pin: sessionPin });
+    if (r.status !== 200) throw new Error("нет доступа к настройкам (" + r.status + ")");
+    token = r.data.access_token;
     tokenAt = Date.now();
     return token;
   }
@@ -872,13 +864,14 @@ <h2 id="pin-title">Введите PIN</h2>
     osk.hide();
     content.innerHTML = "";
     token = null;
+    sessionPin = null;
   }
   gear.addEventListener("click", openModal);
   $("m-close").addEventListener("click", closeModal);
   $("m-lock").addEventListener("click", closeModal);
 
   /* ---------------- PIN pad ---------------- */
-  let pinMode = "enter", pinBuf = "", pinFirst = "", fails = 0, lockedUntil = 0, lockTimer = null, changing = false;
+  let pinMode = "enter", pinBuf = "", pinFirst = "", lockedUntil = 0, lockTimer = null, changing = false;
   const dots = $("pin-dots").children, hint = $("pin-hint"), title = $("pin-title");
 
   function setHint(text, err) { hint.textContent = text || ""; hint.classList.toggle("err", !!err); }
@@ -898,12 +891,18 @@ <h2 id="pin-title">Введите PIN</h2>
     pad.append(key("⌫", backspace, "fn"));
   }
 
-  function startPinEntry() {
+  async function startPinEntry() {
     changing = false;
     pinBox.style.display = "flex"; mainBox.style.display = "none";
     $("m-lock").style.display = "none";
     pinBuf = ""; pinFirst = "";
-    pinMode = storeGet() ? "enter" : "setup1";
+    pinMode = "enter";
+    paintPinMode();
+    setHint("Проверяю…");
+    const r = await pinCall("/boot/api/pin");
+    if (r.status !== 200) { setHint("Настройки недоступны (" + r.status + ")", true); return; }
+    pinMode = r.data.set ? "enter" : "setup1";
+    if (r.data.locked_for > 0) lockedUntil = Date.now() + r.data.locked_for * 1000;
     paintPinMode();
   }
 
@@ -946,18 +945,21 @@ <h2 id="pin-title">Введите PIN</h2>
     const entered = pinBuf;
     pinBuf = ""; renderDots();
     if (pinMode === "enter") {
-      const saved = storeGet();
-      if (saved && (await hashPin(entered, saved.salt)) === saved.hash) { fails = 0; unlocked = true; showMain(); return; }
-      fails += 1; shake();
-      if (fails >= 5) { fails = 0; lockedUntil = Date.now() + 30000; refreshLockout(); }
-      else setHint("Неверный PIN (" + fails + "/5)", true);
+      const r = await pinCall("/boot/api/session", { pin: entered });
+      if (r.status === 200) { sessionPin = entered; token = r.data.access_token; tokenAt = Date.now(); unlocked = true; showMain(); return; }
+      shake();
+      if (r.status === 429) { lockedUntil = Date.now() + ((r.data.detail && r.data.detail.retry_after) || 30) * 1000; refreshLockout(); }
+      else if (r.status === 401) setHint("Неверный PIN. Осталось попыток: " + (r.data.detail && r.data.detail.attempts_left), true);
+      else setHint("Ошибка " + r.status, true);
     } else if (pinMode === "setup1") {
       pinFirst = entered; pinMode = "setup2"; paintPinMode();
     } else {
       if (entered !== pinFirst) { shake(); pinMode = "setup1"; paintPinMode(); setHint("PIN не совпал — введите заново", true); return; }
-      const salt = Math.random().toString(36).slice(2) + Date.now().toString(36);
-      const ok = storeSet({ salt, hash: await hashPin(entered, salt) });
-      if (!ok) { setHint("Не удалось сохранить PIN в браузере", true); return; }
+      const r = changing
+        ? await pinCall("/boot/api/pin/change", { current: sessionPin, new: entered })
+        : await pinCall("/boot/api/pin/setup", { pin: entered });
+      if (r.status !== 200) { setHint("Не удалось сохранить PIN (" + r.status + ")", true); return; }
+      sessionPin = entered; token = r.data.access_token || null; tokenAt = Date.now();
       unlocked = true; changing = false; showMain();
     }
   }