feat: webauthn (#2707)

This implements Webauthn. Old devices can be used to authenticate via the appid compatibility layer which should be automatic. New devices will be registered via Webauthn, and devices which do not support FIDO2 will no longer be able to be registered. At this time it does not fully support multiple devices (backend does, frontend doesn't allow registration of additional devices). Does not support passwordless.

1 files changed, 29 insertions, 1 deletions

diff --git a/internal/storage/sql_provider_backend_sqlite.go b/internal/storage/sql_provider_backend_sqlite.go
index 95b398978..e1f6d701c 100644
--- a/internal/storage/sql_provider_backend_sqlite.go
+++ b/internal/storage/sql_provider_backend_sqlite.go
@@ -1,6 +1,10 @@
 package storage
 
 import (
+	"database/sql"
+	"encoding/base64"
+
+	"github.com/mattn/go-sqlite3"
 	_ "github.com/mattn/go-sqlite3" // Load the SQLite Driver used in the connection string.
 
 	"github.com/authelia/authelia/v4/internal/configuration/schema"
@@ -14,7 +18,7 @@ type SQLiteProvider struct {
 // NewSQLiteProvider constructs a SQLite provider.
 func NewSQLiteProvider(config *schema.Configuration) (provider *SQLiteProvider) {
 	provider = &SQLiteProvider{
-		SQLProvider: NewSQLProvider(config, providerSQLite, "sqlite3", config.Storage.Local.Path),
+		SQLProvider: NewSQLProvider(config, providerSQLite, "sqlite3e", config.Storage.Local.Path),
 	}
 
 	// All providers have differing SELECT existing table statements.
@@ -22,3 +26,27 @@ func NewSQLiteProvider(config *schema.Configuration) (provider *SQLiteProvider)
 
 	return provider
 }
+
+func sqlite3BLOBToTEXTBase64(data []byte) (b64 string) {
+	return base64.StdEncoding.EncodeToString(data)
+}
+
+func sqlite3TEXTBase64ToBLOB(b64 string) (data []byte, err error) {
+	return base64.StdEncoding.DecodeString(b64)
+}
+
+func init() {
+	sql.Register("sqlite3e", &sqlite3.SQLiteDriver{
+		ConnectHook: func(conn *sqlite3.SQLiteConn) (err error) {
+			if err = conn.RegisterFunc("BIN2B64", sqlite3BLOBToTEXTBase64, true); err != nil {
+				return err
+			}
+
+			if err = conn.RegisterFunc("B642BIN", sqlite3TEXTBase64ToBLOB, true); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	})
+}