| """Publish/fetch the split-key credential halves. |
| |
| PC side (has tokens): publish the HF half to the public HF dataset and the GitHub half |
| to the public GitHub repo. Client side (no token): fetch both halves from the public URLs |
| so login works when the PC is offline (yahbible_auth.login reconstructs + decrypts). |
| |
| Public is safe: each half is one leg of an OTP split (useless alone) and the whole is |
| still AES-GCM-encrypted under the password. The GitHub repo is the "passwords" store in |
| the sense that its data is encrypted, not that the repo is access-restricted -- a |
| restricted repo could not be read token-free by an offline client. |
| """ |
| from __future__ import annotations |
| import base64 |
| import json |
| import subprocess |
| import urllib.request |
|
|
| HF_REPO = "OhBeOneKeyNoBe/yahbible-auth" |
| GH_REPO = "OhBeOneKeyNoBe/yahbible-auth" |
| HF_BASE = "https://huggingface.co/datasets/%s/resolve/main" % HF_REPO |
| GH_RAW = "https://raw.githubusercontent.com/%s/main" % GH_REPO |
|
|
|
|
| def publish_hf(uhash: str, hf_record: dict, token: str | None = None): |
| from huggingface_hub import upload_file |
| data = json.dumps(hf_record, separators=(",", ":")).encode() |
| upload_file(path_or_fileobj=data, path_in_repo="auth/%s.json" % uhash, |
| repo_id=HF_REPO, repo_type="dataset", token=token, |
| commit_message="auth half (HF) for %s" % uhash) |
|
|
|
|
| def _gh(args: list) -> tuple: |
| p = subprocess.run(["gh", "api"] + args, capture_output=True, text=True) |
| return p.returncode, p.stdout, p.stderr |
|
|
|
|
| def publish_gh(uhash: str, gh_record: dict): |
| """Write auth/<uhash>.json via the GitHub contents API (gh CLI holds the token).""" |
| path = "repos/%s/contents/auth/%s.json" % (GH_REPO, uhash) |
| content = base64.b64encode(json.dumps(gh_record, separators=(",", ":")).encode()).decode() |
| rc, out, _ = _gh([path, "--jq", ".sha"]) |
| args = [path, "--method", "PUT", |
| "-f", "message=auth half (GitHub) for %s" % uhash, |
| "-f", "content=%s" % content] |
| if rc == 0 and out.strip() and out.strip() != "null": |
| args += ["-f", "sha=%s" % out.strip()] |
| rc2, out2, err2 = _gh(args) |
| if rc2 != 0: |
| raise RuntimeError("gh publish failed: " + (err2 or out2)[:200]) |
|
|
|
|
| def publish(record: dict, hf_token: str | None = None): |
| """Publish both halves of a signup()/change_password() record.""" |
| publish_hf(record["uhash"], record["hf"], token=hf_token) |
| publish_gh(record["uhash"], record["gh"]) |
|
|
|
|
| def _alias_uhash(ident: str) -> str: |
| import hashlib |
| return hashlib.sha256(("yahbible:user:" + ident.strip().lower()).encode()).hexdigest()[:32] |
|
|
|
|
| def publish_aliases(record: dict, aliases: list, hf_token: str | None = None): |
| """Publish the SAME record under extra lookup filenames (username / email / handle) |
| so a client can find it by whatever identifier the user types. The record content |
| (and its internal uhash = the AES-GCM AAD) is unchanged; only the filename varies.""" |
| seen = set() |
| for a in aliases: |
| if not a: |
| continue |
| uh = _alias_uhash(a) |
| if uh in seen: |
| continue |
| seen.add(uh) |
| publish_hf(uh, record["hf"], token=hf_token) |
| publish_gh(uh, record["gh"]) |
|
|
|
|
| def _get(url: str, timeout: float = 30) -> dict | None: |
| try: |
| req = urllib.request.Request(url, headers={"User-Agent": "yahbible"}) |
| with urllib.request.urlopen(req, timeout=timeout) as r: |
| return json.loads(r.read().decode()) |
| except Exception: |
| return None |
|
|
|
|
| def fetch_halves(uhash: str, timeout: float = 30) -> tuple: |
| """Client-side, token-free: fetch (hf_record, gh_record) from the public URLs.""" |
| return (_get("%s/auth/%s.json" % (HF_BASE, uhash), timeout), |
| _get("%s/auth/%s.json" % (GH_RAW, uhash), timeout)) |
|
|
