Add code, report, and presentation for Beckmann

.dockerignore

@@ -0,0 +1,36 @@
+test-results
+node_modules
+
+# Output
+.output
+.vercel
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# jetbrains setting folder
+.idea/
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+
+# SQLite
+*.db
+
+# Docker
+Dockerfile
+Dockerfile.migrate
+docker-compose.yaml
+
+# Deployment
+deploy.sh

.env.example

@@ -0,0 +1 @@
+DATABASE_URL=local.db

.gitignore

@@ -0,0 +1,28 @@
+test-results
+node_modules
+
+# Output
+.output
+.vercel
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# jetbrains setting folder
+.idea/
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+
+# SQLite
+*.db

.npmrc

@@ -0,0 +1 @@
+engine-strict=true

Dockerfile

@@ -0,0 +1,44 @@
+# Adjust BUN_VERSION as desired
+ARG BUN_VERSION=1.1.36
+FROM oven/bun:${BUN_VERSION}-slim AS base
+
+# Base image
+WORKDIR /app
+ENV NODE_ENV="production"
+
+
+FROM base AS build
+
+# Install packages needed to build node modules
+RUN apt-get update -qq && \
+    apt-get install -y --no-install-recommends build-essential pkg-config python-is-python3
+
+# Install node modules
+COPY --link package.json bun.lockb ./
+RUN bun install
+
+# Copy application code
+COPY --link . .
+
+# Build application
+RUN bunx svelte-kit sync
+RUN DATABASE_URL=blabla bun run build
+
+## Remove development dependencies
+RUN rm -rf node_modules && \
+    bun install --production
+
+
+# Final stage for app image
+FROM base AS app
+
+# Copy built application
+COPY --from=build /app/node_modules /app/node_modules
+COPY --from=build /app/build /app/build
+
+ENV PORT=4321
+ENV HOST=0.0.0.0
+
+# Start the server by default, this can be overwritten at runtime
+EXPOSE 4321
+CMD ["bun", "./build"]

Dockerfile.migrate

@@ -0,0 +1,28 @@
+# Adjust BUN_VERSION as desired
+ARG BUN_VERSION=1.1.36
+FROM node:20-slim AS base
+
+# Base image
+WORKDIR /app
+ENV NODE_ENV="production"
+
+# Install packages needed to build node modules
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential pkg-config python-is-python3
+
+# Install bun
+RUN npm install -g bun@${BUN_VERSION}
+
+
+FROM base AS build
+
+# Install node modules
+COPY --link package.json bun.lockb ./
+RUN bun install
+
+# Copy application code
+COPY --link drizzle/ ./drizzle/
+COPY --link drizzle.config.ts ./
+
+# Migrate the database
+CMD ["bun", "run", "db", "migrate"]

README.md

@@ -1,2 +1,50 @@
-# Cybersecurity-projects-2024
-Projects of the Cybersecurity course 2024/25, University of Bologna
+# sv
+
+## Use cases
+
+- [x] Register
+  - Username
+  - Password
+    -> Returns session token and user database chunk
+- [x] Login
+  - Username
+  - Password
+    -> Returns session token and user database chunk
+- [x] Get current session
+- [x] Change password
+- [ ] Upload file
+  1. Select file
+  2. Chunk file using fast-cdc
+  3. Encrypt file
+  4. Upload chunks
+  5. Update local database
+  6. Chunk local database using fast-cdc
+  7. Encrypt local database
+  8. Upload chunks
+- [ ] Download file
+  1. Download chunks
+  2. Join chunks and restore blob
+  3. Decrypt blob
+- [ ] Delete file
+  1. Delete chunks
+  2. Update local database
+  3. Encrypt local database
+  4. Chunk local database using fast-cdc
+  5. Upload chunks
+
+## Thoughts
+
+- Use `zlib` to compress the local database
+
+## Current issues
+
+- Registration leaks the information whether a username exists or not
+- Does the second request of the login procedure properly prevent timing attacks?
+- Is my own implementation of signing the session id secure?
+- Is sending the signed session id as a cookie secure?
+- What if an upload takes longer than 24 hours when the `upload` record is deleted?
+- We have to take all data of the user into consideration when calculating their storage usage because evil people could
+  just hide their data in the database
+  - Take the 40 bytes overhead into consideration
+  - Encrypted file attributes
+  - Any keys the user uploads 

components.json

@@ -0,0 +1,17 @@
+{
+	"$schema": "https://next.shadcn-svelte.com/schema.json",
+	"style": "default",
+	"tailwind": {
+		"config": "tailwind.config.ts",
+		"css": "src/app.css",
+		"baseColor": "stone"
+	},
+	"aliases": {
+		"components": "$lib/components",
+		"utils": "$lib/utils/components",
+		"ui": "$lib/components/ui",
+		"hooks": "$lib/hooks"
+	},
+	"typescript": true,
+	"registry": "https://next.shadcn-svelte.com/registry"
+}

deploy.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# This will build and restart to the production container.
+set -e
+
+server=stefan
+app_root=/home/amadeus/http/csp
+app_storage=/home/amadeus/storage/csp
+app_url=https://csp.deer13.dev
+
+echo -e '\033[1mDeploying...\033[0m'
+echo $app_url
+echo
+
+rsync -vhra \
+  . \
+  $server:$app_root \
+  --include='**.gitignore' \
+  --exclude='/.git' \
+  --filter=':- .gitignore' \
+  --delete-after
+
+ssh $server << EOF
+  set -e
+
+  cd $app_root
+
+  # Build images
+  docker build -f Dockerfile -t llamadeus/csp .
+  docker build -f Dockerfile.migrate -t llamadeus/csp-migrate .
+
+  # Stop container
+  docker compose stop
+
+  # Migrate
+  docker run --rm -e DATABASE_URL="/app/db/prod.db" -v "/home/amadeus/storage/csp/db":"/app/db" llamadeus/csp-migrate
+
+  # Restart container
+  docker compose up -d
+
+  # Clean up cached resources (anything older than 7 days)
+  yes | docker image prune -a --filter "until=168h"
+  yes | docker builder prune -a --filter "until=168h"
+EOF

docker-compose.yaml

@@ -0,0 +1,18 @@
+services:
+  web:
+    image: llamadeus/csp
+    restart: unless-stopped
+    networks:
+      - caddy
+    labels:
+      caddy: csp.deer13.dev
+      caddy.reverse_proxy: "{{upstreams 4321}}"
+    volumes:
+      - /home/amadeus/storage/csp/db:/app/db
+    environment:
+      - PUBLIC_APP_URL=https://csp.deer13.dev
+      - DATABASE_URL=/app/db/prod.db
+
+networks:
+  caddy:
+    external: true

drizzle.config.ts

@@ -0,0 +1,18 @@
+import { defineConfig } from "drizzle-kit";
+
+
+if (! process.env.DATABASE_URL) {
+  throw new Error("DATABASE_URL is not set");
+}
+
+export default defineConfig({
+  schema: "./src/lib/server/db/schema.ts",
+
+  dbCredentials: {
+    url: process.env.DATABASE_URL,
+  },
+
+  verbose: true,
+  strict: true,
+  dialect: "sqlite",
+});

drizzle/0000_the_friendly_executioner.sql

@@ -0,0 +1,35 @@
+CREATE TABLE `chunks` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`blob` blob NOT NULL,
+	`created_at` integer NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE TABLE `files` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`key` text NOT NULL,
+	`cmac` text NOT NULL,
+	`attributes` text NOT NULL,
+	`created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `sessions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`session_id` text NOT NULL,
+	`created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `sessions_session_id_unique` ON `sessions` (`session_id`);--> statement-breakpoint
+CREATE TABLE `users` (
+	`id` text PRIMARY KEY NOT NULL,
+	`username` text NOT NULL,
+	`crv` text NOT NULL,
+	`hak` text NOT NULL,
+	`key` text NOT NULL,
+	`created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `users_username_unique` ON `users` (`username`);

drizzle/0001_watery_eternals.sql

@@ -0,0 +1,34 @@
+CREATE TABLE `slot_chunks` (
+	`slot_id` text NOT NULL,
+	`chunk_id` text NOT NULL,
+	PRIMARY KEY(`slot_id`, `chunk_id`),
+	FOREIGN KEY (`slot_id`) REFERENCES `slots`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`chunk_id`) REFERENCES `chunks`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE TABLE `slots` (
+	`id` text PRIMARY KEY NOT NULL,
+	`vault_id` text NOT NULL,
+	`max_size` integer NOT NULL,
+	`attributes` text NOT NULL,
+	`file_x25519_public_key` text,
+	`file_id` text,
+	`created_at` integer NOT NULL,
+	FOREIGN KEY (`vault_id`) REFERENCES `vaults`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`file_id`) REFERENCES `files`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE TABLE `vaults` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`token` text NOT NULL,
+	`key` text NOT NULL,
+	`attributes` text NOT NULL,
+	`auth_ed25519_private_key` text NOT NULL,
+	`auth_ed25519_public_key` text NOT NULL,
+	`created_at` integer NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+ALTER TABLE `users` ADD `x25519_private_key` text;--> statement-breakpoint
+ALTER TABLE `users` ADD `x25519_public_key` text;