|
| 1 | +"""Utilities for dashboard password hashing and verification.""" |
| 2 | + |
| 3 | +import hashlib |
| 4 | +import hmac |
| 5 | +import re |
| 6 | +import secrets |
| 7 | + |
| 8 | +try: |
| 9 | + import argon2.exceptions as argon2_exceptions |
| 10 | + from argon2 import PasswordHasher |
| 11 | + |
| 12 | + _PASSWORD_HASHER = PasswordHasher() |
| 13 | +except ImportError: |
| 14 | + _PASSWORD_HASHER = None |
| 15 | + |
| 16 | +_PBKDF2_ITERATIONS = 600_000 |
| 17 | +_PBKDF2_SALT_BYTES = 16 |
| 18 | +_PBKDF2_ALGORITHM = "pbkdf2_sha256" |
| 19 | +_PBKDF2_FORMAT = f"{_PBKDF2_ALGORITHM}$" |
| 20 | +_LEGACY_MD5_LENGTH = 32 |
| 21 | +_DASHBOARD_PASSWORD_MIN_LENGTH = 12 |
| 22 | +DEFAULT_DASHBOARD_PASSWORD = "astrbot" |
| 23 | + |
| 24 | + |
| 25 | +def hash_dashboard_password(raw_password: str) -> str: |
| 26 | + """Return a salted hash for dashboard password using Argon2 (if available) or PBKDF2-HMAC-SHA256 fallback.""" |
| 27 | + if not isinstance(raw_password, str) or raw_password == "": |
| 28 | + raise ValueError("Password cannot be empty") |
| 29 | + |
| 30 | + if _PASSWORD_HASHER is not None: |
| 31 | + try: |
| 32 | + return _PASSWORD_HASHER.hash(raw_password) |
| 33 | + except Exception as e: |
| 34 | + raise ValueError(f"Failed to hash password securely (argon2): {e!s}") from e |
| 35 | + |
| 36 | + salt = secrets.token_hex(_PBKDF2_SALT_BYTES) |
| 37 | + digest = hashlib.pbkdf2_hmac( |
| 38 | + "sha256", |
| 39 | + raw_password.encode("utf-8"), |
| 40 | + bytes.fromhex(salt), |
| 41 | + _PBKDF2_ITERATIONS, |
| 42 | + ).hex() |
| 43 | + return f"{_PBKDF2_FORMAT}{_PBKDF2_ITERATIONS}${salt}${digest}" |
| 44 | + |
| 45 | + |
| 46 | +def validate_dashboard_password(raw_password: str) -> None: |
| 47 | + """Validate whether dashboard password meets the minimal complexity policy.""" |
| 48 | + if not isinstance(raw_password, str) or raw_password == "": |
| 49 | + raise ValueError("Password cannot be empty") |
| 50 | + if len(raw_password) < _DASHBOARD_PASSWORD_MIN_LENGTH: |
| 51 | + raise ValueError( |
| 52 | + f"Password must be at least {_DASHBOARD_PASSWORD_MIN_LENGTH} characters long" |
| 53 | + ) |
| 54 | + |
| 55 | + if not re.search(r"[A-Z]", raw_password): |
| 56 | + raise ValueError("Password must include at least one uppercase letter") |
| 57 | + if not re.search(r"[a-z]", raw_password): |
| 58 | + raise ValueError("Password must include at least one lowercase letter") |
| 59 | + if not re.search(r"\d", raw_password): |
| 60 | + raise ValueError("Password must include at least one digit") |
| 61 | + |
| 62 | + |
| 63 | +def normalize_dashboard_password_hash(stored_password: str) -> str: |
| 64 | + """Ensure dashboard password has a value, fallback to default dashboard password hash.""" |
| 65 | + if not stored_password: |
| 66 | + return hash_dashboard_password(DEFAULT_DASHBOARD_PASSWORD) |
| 67 | + return stored_password |
| 68 | + |
| 69 | + |
| 70 | +def _is_legacy_md5_hash(stored: str) -> bool: |
| 71 | + return ( |
| 72 | + isinstance(stored, str) |
| 73 | + and len(stored) == _LEGACY_MD5_LENGTH |
| 74 | + and all(c in "0123456789abcdefABCDEF" for c in stored) |
| 75 | + ) |
| 76 | + |
| 77 | + |
| 78 | +def _is_pbkdf2_hash(stored: str) -> bool: |
| 79 | + return isinstance(stored, str) and stored.startswith(_PBKDF2_FORMAT) |
| 80 | + |
| 81 | + |
| 82 | +def _is_argon2_hash(stored: str) -> bool: |
| 83 | + return isinstance(stored, str) and stored.startswith("$argon2") |
| 84 | + |
| 85 | + |
| 86 | +def verify_dashboard_password(stored_hash: str, candidate_password: str) -> bool: |
| 87 | + """Verify password against legacy md5, new PBKDF2-SHA256 format, or Argon2.""" |
| 88 | + if not isinstance(stored_hash, str) or not isinstance(candidate_password, str): |
| 89 | + return False |
| 90 | + |
| 91 | + if _is_argon2_hash(stored_hash): |
| 92 | + if _PASSWORD_HASHER is None: |
| 93 | + return False |
| 94 | + try: |
| 95 | + return _PASSWORD_HASHER.verify(stored_hash, candidate_password) |
| 96 | + except argon2_exceptions.VerifyMismatchError: |
| 97 | + return False |
| 98 | + except Exception: |
| 99 | + return False |
| 100 | + |
| 101 | + if _is_legacy_md5_hash(stored_hash): |
| 102 | + # Keep compatibility with existing md5-based deployments: |
| 103 | + # new clients send plain password, old clients may send md5 of it. |
| 104 | + candidate_md5 = hashlib.md5(candidate_password.encode("utf-8")).hexdigest() |
| 105 | + return hmac.compare_digest( |
| 106 | + stored_hash.lower(), candidate_md5.lower() |
| 107 | + ) or hmac.compare_digest( |
| 108 | + stored_hash.lower(), |
| 109 | + candidate_password.lower(), |
| 110 | + ) |
| 111 | + |
| 112 | + if _is_pbkdf2_hash(stored_hash): |
| 113 | + parts: list[str] = stored_hash.split("$") |
| 114 | + if len(parts) != 4: |
| 115 | + return False |
| 116 | + _, iterations_s, salt, digest = parts |
| 117 | + try: |
| 118 | + iterations = int(iterations_s) |
| 119 | + stored_key = bytes.fromhex(digest) |
| 120 | + salt_bytes = bytes.fromhex(salt) |
| 121 | + except (TypeError, ValueError): |
| 122 | + return False |
| 123 | + candidate_key = hashlib.pbkdf2_hmac( |
| 124 | + "sha256", |
| 125 | + candidate_password.encode("utf-8"), |
| 126 | + salt_bytes, |
| 127 | + iterations, |
| 128 | + ) |
| 129 | + return hmac.compare_digest(stored_key, candidate_key) |
| 130 | + |
| 131 | + # Legacy SHA-256 fallback compatibility |
| 132 | + if len(stored_hash) == 64 and all( |
| 133 | + c in "0123456789abcdefABCDEF" for c in stored_hash |
| 134 | + ): |
| 135 | + candidate_sha256 = hashlib.sha256( |
| 136 | + candidate_password.encode("utf-8") |
| 137 | + ).hexdigest() |
| 138 | + return hmac.compare_digest( |
| 139 | + stored_hash.lower(), candidate_sha256.lower() |
| 140 | + ) or hmac.compare_digest(stored_hash.lower(), candidate_password.lower()) |
| 141 | + |
| 142 | + return False |
| 143 | + |
| 144 | + |
| 145 | +def is_default_dashboard_password(stored_hash: str) -> bool: |
| 146 | + """Check whether the password still equals the built-in default value.""" |
| 147 | + return verify_dashboard_password(stored_hash, DEFAULT_DASHBOARD_PASSWORD) |
| 148 | + |
| 149 | + |
| 150 | +def is_legacy_dashboard_password(stored_hash: str) -> bool: |
| 151 | + """Check whether the password is still stored with legacy MD5 or plain SHA256.""" |
| 152 | + if not isinstance(stored_hash, str) or not stored_hash: |
| 153 | + return False |
| 154 | + if _is_legacy_md5_hash(stored_hash): |
| 155 | + return True |
| 156 | + if len(stored_hash) == 64 and all( |
| 157 | + c in "0123456789abcdefABCDEF" for c in stored_hash |
| 158 | + ): |
| 159 | + return True |
| 160 | + return False |
0 commit comments