|
| 1 | +"""Utilities for dashboard password hashing and verification.""" |
| 2 | + |
| 3 | +import hashlib |
| 4 | +import hmac |
| 5 | +import re |
| 6 | +import secrets |
| 7 | + |
| 8 | +_PBKDF2_ITERATIONS = 200_000 |
| 9 | +_PBKDF2_SALT_BYTES = 16 |
| 10 | +_PBKDF2_ALGORITHM = "pbkdf2_sha256" |
| 11 | +_PBKDF2_FORMAT = f"{_PBKDF2_ALGORITHM}$" |
| 12 | +_LEGACY_MD5_LENGTH = 32 |
| 13 | +_DASHBOARD_PASSWORD_MIN_LENGTH = 12 |
| 14 | +DEFAULT_DASHBOARD_PASSWORD = "astrbot" |
| 15 | + |
| 16 | + |
| 17 | +def hash_dashboard_password(raw_password: str) -> str: |
| 18 | + """Return a salted hash for dashboard password using PBKDF2-HMAC-SHA256.""" |
| 19 | + if not isinstance(raw_password, str) or raw_password == "": |
| 20 | + raise ValueError("Password cannot be empty") |
| 21 | + |
| 22 | + salt = secrets.token_hex(_PBKDF2_SALT_BYTES) |
| 23 | + digest = hashlib.pbkdf2_hmac( |
| 24 | + "sha256", |
| 25 | + raw_password.encode("utf-8"), |
| 26 | + bytes.fromhex(salt), |
| 27 | + _PBKDF2_ITERATIONS, |
| 28 | + ).hex() |
| 29 | + return f"{_PBKDF2_FORMAT}{_PBKDF2_ITERATIONS}${salt}${digest}" |
| 30 | + |
| 31 | + |
| 32 | +def validate_dashboard_password(raw_password: str) -> None: |
| 33 | + """Validate whether dashboard password meets the minimal complexity policy.""" |
| 34 | + if not isinstance(raw_password, str) or raw_password == "": |
| 35 | + raise ValueError("Password cannot be empty") |
| 36 | + if len(raw_password) < _DASHBOARD_PASSWORD_MIN_LENGTH: |
| 37 | + raise ValueError( |
| 38 | + f"Password must be at least {_DASHBOARD_PASSWORD_MIN_LENGTH} characters long" |
| 39 | + ) |
| 40 | + |
| 41 | + if not re.search(r"[A-Z]", raw_password): |
| 42 | + raise ValueError("Password must include at least one uppercase letter") |
| 43 | + if not re.search(r"[a-z]", raw_password): |
| 44 | + raise ValueError("Password must include at least one lowercase letter") |
| 45 | + if not re.search(r"\d", raw_password): |
| 46 | + raise ValueError("Password must include at least one digit") |
| 47 | + |
| 48 | + |
| 49 | +def normalize_dashboard_password_hash(stored_password: str) -> str: |
| 50 | + """Ensure dashboard password has a value, fallback to default dashboard password hash.""" |
| 51 | + if not stored_password: |
| 52 | + return hash_dashboard_password(DEFAULT_DASHBOARD_PASSWORD) |
| 53 | + return stored_password |
| 54 | + |
| 55 | + |
| 56 | +def _is_legacy_md5_hash(stored: str) -> bool: |
| 57 | + return ( |
| 58 | + isinstance(stored, str) |
| 59 | + and len(stored) == _LEGACY_MD5_LENGTH |
| 60 | + and all(c in "0123456789abcdefABCDEF" for c in stored) |
| 61 | + ) |
| 62 | + |
| 63 | + |
| 64 | +def _is_pbkdf2_hash(stored: str) -> bool: |
| 65 | + return isinstance(stored, str) and stored.startswith(_PBKDF2_FORMAT) |
| 66 | + |
| 67 | + |
| 68 | +def verify_dashboard_password(stored_hash: str, candidate_password: str) -> bool: |
| 69 | + """Verify password against legacy md5 or new PBKDF2-SHA256 format.""" |
| 70 | + if not isinstance(stored_hash, str) or not isinstance(candidate_password, str): |
| 71 | + return False |
| 72 | + |
| 73 | + if _is_legacy_md5_hash(stored_hash): |
| 74 | + # Keep compatibility with existing md5-based deployments: |
| 75 | + # new clients send plain password, old clients may send md5 of it. |
| 76 | + candidate_md5 = hashlib.md5(candidate_password.encode("utf-8")).hexdigest() |
| 77 | + return hmac.compare_digest( |
| 78 | + stored_hash.lower(), candidate_md5.lower() |
| 79 | + ) or hmac.compare_digest( |
| 80 | + stored_hash.lower(), |
| 81 | + candidate_password.lower(), |
| 82 | + ) |
| 83 | + |
| 84 | + if _is_pbkdf2_hash(stored_hash): |
| 85 | + parts: list[str] = stored_hash.split("$") |
| 86 | + if len(parts) != 4: |
| 87 | + return False |
| 88 | + _, iterations_s, salt, digest = parts |
| 89 | + try: |
| 90 | + iterations = int(iterations_s) |
| 91 | + stored_key = bytes.fromhex(digest) |
| 92 | + salt_bytes = bytes.fromhex(salt) |
| 93 | + except (TypeError, ValueError): |
| 94 | + return False |
| 95 | + candidate_key = hashlib.pbkdf2_hmac( |
| 96 | + "sha256", |
| 97 | + candidate_password.encode("utf-8"), |
| 98 | + salt_bytes, |
| 99 | + iterations, |
| 100 | + ) |
| 101 | + return hmac.compare_digest(stored_key, candidate_key) |
| 102 | + |
| 103 | + return False |
| 104 | + |
| 105 | + |
| 106 | +def is_default_dashboard_password(stored_hash: str) -> bool: |
| 107 | + """Check whether the password still equals the built-in default value.""" |
| 108 | + return verify_dashboard_password(stored_hash, DEFAULT_DASHBOARD_PASSWORD) |
| 109 | + |
| 110 | + |
| 111 | +def is_legacy_dashboard_password(stored_hash: str) -> bool: |
| 112 | + """Check whether the password is still stored with legacy MD5.""" |
| 113 | + return _is_legacy_md5_hash(stored_hash) |
0 commit comments