474 lines
11 KiB
Go
474 lines
11 KiB
Go
package login
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"log/slog"
|
|
stdhttp "net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/ayn2op/discordo/internal/config"
|
|
apphttp "github.com/ayn2op/discordo/internal/http"
|
|
"github.com/ayn2op/discordo/internal/ui"
|
|
"github.com/ayn2op/tview"
|
|
"github.com/diamondburned/arikawa/v3/api"
|
|
"github.com/gdamore/tcell/v2"
|
|
"github.com/gorilla/websocket"
|
|
"github.com/skip2/go-qrcode"
|
|
)
|
|
|
|
const gatewayURL = "wss://remote-auth-gateway.discord.gg/?v=2"
|
|
|
|
var remoteAuthLogin = api.EndpointMe + "/remote-auth/login"
|
|
|
|
type qrLogin struct {
|
|
*tview.TextView
|
|
app *tview.Application
|
|
cfg *config.Config
|
|
view *tview.TextView
|
|
done func(token string, err error)
|
|
conn *websocket.Conn
|
|
privKey *rsa.PrivateKey
|
|
cancel context.CancelFunc
|
|
fingerprint string
|
|
}
|
|
|
|
func newQRLogin(app *tview.Application, cfg *config.Config, done func(token string, err error)) *qrLogin {
|
|
view := tview.NewTextView().
|
|
SetDynamicColors(true).
|
|
SetScrollable(true).
|
|
SetWrap(false).
|
|
SetTextAlign(tview.AlignmentCenter)
|
|
view.Box = ui.ConfigureBox(view.Box, &cfg.Theme)
|
|
view.SetTitle("Login with QR")
|
|
|
|
q := &qrLogin{
|
|
app: app,
|
|
cfg: cfg,
|
|
view: view,
|
|
done: done,
|
|
}
|
|
q.TextView = view
|
|
|
|
view.SetChangedFunc(func() {
|
|
q.app.QueueUpdateDraw(func() {})
|
|
})
|
|
|
|
view.SetInputCapture(func(ev *tcell.EventKey) *tcell.EventKey {
|
|
if ev.Key() == tcell.KeyEsc {
|
|
q.stop()
|
|
if q.done != nil {
|
|
q.done("", nil)
|
|
}
|
|
return nil
|
|
}
|
|
return ev
|
|
})
|
|
|
|
return q
|
|
}
|
|
|
|
|
|
func (q *qrLogin) centerText(s string) string {
|
|
_, _, _, height := q.view.GetInnerRect()
|
|
if height == 0 {
|
|
height = 40
|
|
}
|
|
lines := strings.Count(s, "\n") + 1
|
|
padding := (height - lines) / 2
|
|
if padding < 0 {
|
|
padding = 0
|
|
} else if padding < 1 && height > lines {
|
|
padding = 1
|
|
}
|
|
return strings.Repeat("\n", padding) + s
|
|
}
|
|
|
|
func (q *qrLogin) start() {
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
q.cancel = cancel
|
|
go q.run(ctx)
|
|
}
|
|
|
|
func (q *qrLogin) stop() {
|
|
if q.cancel != nil {
|
|
q.cancel()
|
|
}
|
|
if q.conn != nil {
|
|
q.conn.Close()
|
|
}
|
|
}
|
|
|
|
func (q *qrLogin) writeJSON(data any) error {
|
|
return q.conn.WriteJSON(data)
|
|
}
|
|
|
|
type raHello struct {
|
|
TimeoutMs int `json:"timeout_ms"`
|
|
HeartbeatInterval int `json:"heartbeat_interval"`
|
|
}
|
|
|
|
type raNonceProof struct {
|
|
EncryptedNonce string `json:"encrypted_nonce"`
|
|
}
|
|
|
|
type raPendingInit struct {
|
|
Fingerprint string `json:"fingerprint"`
|
|
}
|
|
|
|
type raPendingLogin struct {
|
|
Ticket string `json:"ticket"`
|
|
}
|
|
|
|
type raPendingTicket struct {
|
|
EncryptedUserPayload string `json:"encrypted_user_payload"`
|
|
}
|
|
|
|
func (q *qrLogin) run(ctx context.Context) {
|
|
defer q.stop()
|
|
|
|
setText := func(s string) {
|
|
q.app.QueueUpdateDraw(func() {
|
|
q.view.SetText(q.centerText(s))
|
|
})
|
|
}
|
|
|
|
setText("Preparing QR code...\n\n[::d]Press Esc to cancel[-]")
|
|
|
|
privKey, err := rsa.GenerateKey(rand.Reader, 2048)
|
|
if err != nil {
|
|
q.fail(err)
|
|
return
|
|
}
|
|
q.privKey = privKey
|
|
|
|
pubDER, err := x509.MarshalPKIXPublicKey(&privKey.PublicKey)
|
|
if err != nil {
|
|
q.fail(err)
|
|
return
|
|
}
|
|
encodedPublicKey := base64.StdEncoding.EncodeToString(pubDER)
|
|
|
|
headers := stdhttp.Header{}
|
|
headers.Set("User-Agent", apphttp.BrowserUserAgent)
|
|
headers.Set("Origin", "https://discord.com")
|
|
|
|
setText("Connecting to Remote Auth Gateway...\n\n[::d]Press Esc to cancel[-]")
|
|
|
|
dialer := websocket.Dialer{
|
|
Proxy: stdhttp.ProxyFromEnvironment,
|
|
HandshakeTimeout: 15 * time.Second,
|
|
EnableCompression: true,
|
|
}
|
|
|
|
conn, resp, err := dialer.DialContext(ctx, gatewayURL, headers)
|
|
if err != nil {
|
|
var body []byte
|
|
if resp != nil && resp.Body != nil {
|
|
body, _ = io.ReadAll(resp.Body)
|
|
}
|
|
status := ""
|
|
if resp != nil {
|
|
status = resp.Status
|
|
}
|
|
q.fail(fmt.Errorf("websocket dial failed: %w, status=%s, body=%s", err, status, string(body)))
|
|
return
|
|
}
|
|
q.conn = conn
|
|
|
|
readCh := make(chan []byte, 1)
|
|
readErr := make(chan error, 1)
|
|
go func() {
|
|
for {
|
|
_, data, err := conn.ReadMessage()
|
|
if err != nil {
|
|
readErr <- err
|
|
return
|
|
}
|
|
readCh <- data
|
|
}
|
|
}()
|
|
|
|
var heartbeatTicker *time.Ticker
|
|
defer func() {
|
|
if heartbeatTicker != nil {
|
|
heartbeatTicker.Stop()
|
|
}
|
|
}()
|
|
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return
|
|
case err := <-readErr:
|
|
if mapped := mapWSCloseError(err); mapped == nil {
|
|
return
|
|
} else {
|
|
q.fail(mapped)
|
|
}
|
|
return
|
|
case data := <-readCh:
|
|
var opOnly struct {
|
|
Op string `json:"op"`
|
|
}
|
|
if err := json.Unmarshal(data, &opOnly); err != nil {
|
|
setText("[red]Bad JSON:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
|
|
switch opOnly.Op {
|
|
case "hello":
|
|
var h raHello
|
|
if err := json.Unmarshal(data, &h); err != nil {
|
|
setText("[red]Hello decode failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
if h.HeartbeatInterval > 0 {
|
|
heartbeatTicker = time.NewTicker(time.Duration(h.HeartbeatInterval) * time.Millisecond)
|
|
go func() {
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return
|
|
case <-heartbeatTicker.C:
|
|
_ = q.writeJSON(map[string]any{"op": "heartbeat"})
|
|
}
|
|
}
|
|
}()
|
|
}
|
|
setText("Connected. Handshaking...\n\n[::d]Press Esc to cancel[-]")
|
|
if err := q.writeJSON(map[string]any{
|
|
"op": "init",
|
|
"encoded_public_key": encodedPublicKey,
|
|
}); err != nil {
|
|
setText("[red]Init send failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
case "nonce_proof":
|
|
var n raNonceProof
|
|
if err := json.Unmarshal(data, &n); err != nil {
|
|
setText("[red]Nonce decode failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
enc, err := base64.StdEncoding.DecodeString(n.EncryptedNonce)
|
|
if err != nil {
|
|
setText("[red]Nonce b64 decode failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
pt, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, q.privKey, enc, nil)
|
|
if err != nil {
|
|
setText("[red]Nonce decrypt failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
nonce := base64.RawURLEncoding.EncodeToString(pt)
|
|
if err := q.writeJSON(map[string]any{"op": "nonce_proof", "nonce": nonce}); err != nil {
|
|
setText("[red]Nonce send failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
case "pending_remote_init":
|
|
var p raPendingInit
|
|
if err := json.Unmarshal(data, &p); err != nil {
|
|
setText("[red]Init decode failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
q.fingerprint = p.Fingerprint
|
|
content := "https://discord.com/ra/" + p.Fingerprint
|
|
ascii, err := renderQR(content)
|
|
if err != nil {
|
|
setText("[red]QR render failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
setText(ascii + "\n\n[::b]Scan with Discord mobile app[::-]\n\n[::d]Press Esc to cancel[-]")
|
|
case "heartbeat_ack":
|
|
case "pending_ticket":
|
|
var t raPendingTicket
|
|
if err := json.Unmarshal(data, &t); err != nil {
|
|
setText("[red]Ticket decode failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
payload, err := base64.StdEncoding.DecodeString(t.EncryptedUserPayload)
|
|
if err != nil {
|
|
setText("[red]Ticket payload b64 failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
pt, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, q.privKey, payload, nil)
|
|
if err != nil {
|
|
setText("[red]Ticket payload decrypt failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
parts := strings.SplitN(string(pt), ":", 4)
|
|
var discriminator, username string
|
|
if len(parts) == 4 {
|
|
discriminator = parts[1]
|
|
username = parts[3]
|
|
}
|
|
if discriminator == "" && username == "" {
|
|
setText("Scan received.\n\nWaiting for approval on mobile...\n\n[::d]Press Esc to cancel[-]")
|
|
} else {
|
|
setText("Logging in as [::b]" + username + "[#]" + discriminator + "[::-]\n\nConfirm on mobile...\n\n[::d]Press Esc to cancel[-]")
|
|
}
|
|
case "pending_login":
|
|
var p raPendingLogin
|
|
if err := json.Unmarshal(data, &p); err != nil {
|
|
setText("[red]Login decode failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
setText("Authenticating...\n\n[::d]Please wait[-]")
|
|
token, err := exchangeTicket(ctx, p.Ticket, q.fingerprint, q.privKey)
|
|
if err != nil {
|
|
setText("[red]Ticket exchange failed:[-] " + err.Error())
|
|
q.fail(err)
|
|
return
|
|
}
|
|
q.success(token)
|
|
return
|
|
case "cancel":
|
|
setText("Login canceled on mobile")
|
|
if q.done != nil {
|
|
q.done("", nil)
|
|
}
|
|
return
|
|
default:
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func renderQR(content string) (string, error) {
|
|
code, err := qrcode.New(content, qrcode.Low)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
bm := code.Bitmap()
|
|
var b strings.Builder
|
|
for y := 0; y < len(bm); y += 2 {
|
|
for x := range bm[y] {
|
|
top := bm[y][x]
|
|
bottom := false
|
|
if y+1 < len(bm) {
|
|
bottom = bm[y+1][x]
|
|
}
|
|
if top && bottom {
|
|
b.WriteString("█")
|
|
} else if top && !bottom {
|
|
b.WriteString("▀")
|
|
} else if !top && bottom {
|
|
b.WriteString("▄")
|
|
} else {
|
|
b.WriteString(" ")
|
|
}
|
|
}
|
|
b.WriteByte('\n')
|
|
}
|
|
return b.String(), nil
|
|
}
|
|
|
|
func exchangeTicket(ctx context.Context, ticket string, fingerprint string, priv *rsa.PrivateKey) (string, error) {
|
|
if ticket == "" {
|
|
return "", errors.New("empty ticket")
|
|
}
|
|
body := map[string]string{"ticket": ticket}
|
|
raw, err := json.Marshal(body)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req, err := stdhttp.NewRequestWithContext(ctx, stdhttp.MethodPost, remoteAuthLogin, bytes.NewReader(raw))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
req.Header = apphttp.Headers()
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("User-Agent", apphttp.BrowserUserAgent)
|
|
if fingerprint != "" {
|
|
req.Header.Set("X-Fingerprint", fingerprint)
|
|
req.Header.Set("Referer", "https://discord.com/ra/"+fingerprint)
|
|
}
|
|
|
|
client := &stdhttp.Client{Transport: apphttp.NewTransport(), Timeout: 20 * time.Second}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
|
b, _ := io.ReadAll(resp.Body)
|
|
return "", fmt.Errorf("remote-auth login failed: %s: %s", resp.Status, string(b))
|
|
}
|
|
|
|
decoder := json.NewDecoder(resp.Body)
|
|
|
|
var out struct {
|
|
EncryptedToken string `json:"encrypted_token"`
|
|
}
|
|
if err := decoder.Decode(&out); err != nil {
|
|
return "", err
|
|
}
|
|
if out.EncryptedToken == "" {
|
|
return "", fmt.Errorf("no encrypted_token in response")
|
|
}
|
|
enc, err := base64.StdEncoding.DecodeString(out.EncryptedToken)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
pt, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, priv, enc, nil)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return string(pt), nil
|
|
}
|
|
|
|
func (q *qrLogin) success(token string) {
|
|
if q.done != nil {
|
|
q.done(token, nil)
|
|
}
|
|
}
|
|
|
|
func (q *qrLogin) fail(err error) {
|
|
slog.Error("qr login failed", "err", err)
|
|
if q.done != nil {
|
|
q.done("", err)
|
|
}
|
|
}
|
|
|
|
func mapWSCloseError(err error) error {
|
|
var cerr *websocket.CloseError
|
|
if errors.As(err, &cerr) {
|
|
switch cerr.Code {
|
|
case 1000:
|
|
return errors.New("session closed")
|
|
case 4000:
|
|
return errors.New("remote auth: invalid version")
|
|
case 4001:
|
|
return errors.New("remote auth: decode error")
|
|
case 4002:
|
|
return errors.New("remote auth: handshake failure")
|
|
case 4003:
|
|
return errors.New("remote auth: session timed out")
|
|
}
|
|
}
|
|
return err
|
|
}
|