simpleadmin-web 0.1.0: web panel for CS2-SimpleAdmin

internal/steam/steam.go

@@ -0,0 +1,145 @@
+// Package steam handles "Sign in through Steam" (OpenID 2.0) and SteamID64 validation.
+package steam
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	opEndpoint     = "https://steamcommunity.com/openid/login"
+	openIDNS       = "http://specs.openid.net/auth/2.0"
+	identifierSel  = "http://specs.openid.net/auth/2.0/identifier_select"
+	claimedPrefix  = "https://steamcommunity.com/openid/id/"
+	nonceMaxAge    = 5 * time.Minute
+	steamID64Base  = 76561197960265728
+	steamID64Limit = steamID64Base + 1<<32
+)
+
+var steamID64Re = regexp.MustCompile(`^7656119[0-9]{10}$`)
+
+// ValidID reports whether s is an individual account's SteamID64.
+func ValidID(s string) bool {
+	if !steamID64Re.MatchString(s) {
+		return false
+	}
+	n, err := strconv.ParseUint(s, 10, 64)
+	return err == nil && n > steamID64Base && n < steamID64Limit
+}
+
+// LoginURL is where to send the browser to sign in. returnTo must be under realm.
+func LoginURL(realm, returnTo string) string {
+	q := url.Values{
+		"openid.ns":         {openIDNS},
+		"openid.mode":       {"checkid_setup"},
+		"openid.return_to":  {returnTo},
+		"openid.realm":      {realm},
+		"openid.identity":   {identifierSel},
+		"openid.claimed_id": {identifierSel},
+	}
+	return opEndpoint + "?" + q.Encode()
+}
+
+// Verify checks a callback from Steam with Steam itself and returns the signed-in SteamID64.
+func Verify(ctx context.Context, client *http.Client, returnTo string, q url.Values) (string, error) {
+	if q.Get("openid.mode") != "id_res" {
+		return "", errors.New("steam: sign-in was cancelled")
+	}
+	if q.Get("openid.op_endpoint") != opEndpoint {
+		return "", errors.New("steam: wrong OpenID provider")
+	}
+	if q.Get("openid.return_to") != returnTo {
+		return "", errors.New("steam: return address doesn't match")
+	}
+	claimed := q.Get("openid.claimed_id")
+	if claimed != q.Get("openid.identity") || !strings.HasPrefix(claimed, claimedPrefix) {
+		return "", errors.New("steam: unexpected identity")
+	}
+	id := strings.TrimPrefix(claimed, claimedPrefix)
+	if !ValidID(id) {
+		return "", errors.New("steam: identity isn't a SteamID64")
+	}
+	if err := checkNonce(q.Get("openid.response_nonce")); err != nil {
+		return "", err
+	}
+	// A callback URL is a bearer credential until the nonce expires, so accept each one once.
+	if !seen.claim(q.Get("openid.response_nonce")) {
+		return "", errors.New("steam: this sign-in link was already used")
+	}
+
+	check := url.Values{}
+	for k, v := range q {
+		if strings.HasPrefix(k, "openid.") {
+			check[k] = v
+		}
+	}
+	check.Set("openid.mode", "check_authentication")
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, opEndpoint, strings.NewReader(check.Encode()))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("steam: verify: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	if err != nil {
+		return "", fmt.Errorf("steam: verify: %w", err)
+	}
+	for line := range strings.SplitSeq(string(body), "\n") {
+		if strings.TrimSpace(line) == "is_valid:true" {
+			return id, nil
+		}
+	}
+	return "", errors.New("steam: Steam didn't confirm the sign-in")
+}
+
+// The nonce starts with its UTC creation time, e.g. 2026-09-25T20:00:00Z0a1b2c.
+func checkNonce(nonce string) error {
+	if len(nonce) < 20 {
+		return errors.New("steam: missing nonce")
+	}
+	t, err := time.Parse(time.RFC3339, nonce[:20])
+	if err != nil {
+		return errors.New("steam: bad nonce")
+	}
+	if age := time.Since(t); age > nonceMaxAge || age < -nonceMaxAge {
+		return errors.New("steam: sign-in link expired, try again")
+	}
+	return nil
+}
+
+type nonceSet struct {
+	mu   sync.Mutex
+	used map[string]time.Time
+}
+
+var seen = &nonceSet{used: map[string]time.Time{}}
+
+func (n *nonceSet) claim(nonce string) bool {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	now := time.Now()
+	for k, t := range n.used {
+		if now.Sub(t) > 2*nonceMaxAge {
+			delete(n.used, k)
+		}
+	}
+	if _, ok := n.used[nonce]; ok {
+		return false
+	}
+	n.used[nonce] = now
+	return true
+}

internal/steam/steam_test.go

@@ -0,0 +1,35 @@
+package steam
+
+import (
+	"testing"
+	"time"
+)
+
+func TestValidID(t *testing.T) {
+	for id, want := range map[string]bool{
+		"76561198012345601":  true,
+		"76561197960265728":  false, // account 0
+		"7656119801234560":   false,
+		"76561198012345601 ": false,
+		"86561198012345601":  false,
+		"7656119801234560a":  false,
+	} {
+		if got := ValidID(id); got != want {
+			t.Errorf("ValidID(%q) = %v", id, got)
+		}
+	}
+}
+
+func TestNonce(t *testing.T) {
+	fresh := time.Now().UTC().Format(time.RFC3339) + "abc"
+	if err := checkNonce(fresh); err != nil {
+		t.Fatal(err)
+	}
+	old := time.Now().Add(-10*time.Minute).UTC().Format(time.RFC3339) + "abc"
+	if checkNonce(old) == nil {
+		t.Fatal("old nonce accepted")
+	}
+	if !seen.claim(fresh) || seen.claim(fresh) {
+		t.Fatal("nonce replay not caught")
+	}
+}