Start cleaning up github auth routes

lib/github-auth.js

@@ -108,33 +108,13 @@ function setRoutes(server) {
   });
 
   server.route(/^\/github-auth\/add-token$/, function(data, match, end, ask) {
-    if (!constEq(data.shieldsSecret, serverSecrets.shieldsSecret)) {
+    if (!crypto.timingSafeEqual(data.shieldsSecret, serverSecrets.shieldsSecret)) {
       // An unknown entity tries to connect. Let the connection linger for 10s.
       return setTimeout(function() { end('Invalid secret.'); }, 10000);
     }
     addGithubToken(data.token);
     end('Thanks!');
   });
-
-  // Allow the admin to obtain the tokens for operational and debugging
-  // purposes. This could be used to:
-  //
-  // - Ensure tokens have been propagated to all servers
-  // - Debug GitHub badge failures
-  //
-  // The admin can authenticate with HTTP Basic Auth, with an empty/any
-  // username and the shields secret in the password and an empty/any
-  // password.
-  //
-  // e.g.
-  // curl -u ':very-very-secret' 'https://example.com/$github-auth/tokens'
-  server.ajax.on('github-auth/tokens', (json, end, ask) => {
-    if (! constEq(ask.password, serverSecrets.shieldsSecret)) {
-      // An unknown entity tries to connect. Let the connection linger for a minute.
-      return setTimeout(function() { end('Invalid secret.'); }, 10000);
-    }
-    end(getTokenDebugInfo({ sanitize: false }));
-  });
 }
 
 function sendTokenToAllServers(token) {
@@ -265,7 +245,7 @@ function sha(str) {
     .digest('hex');
 }
 
-function getTokenDebugInfo(options) {
+function serializeDebugInfo(options) {
   // Apply defaults.
   const { sanitize } = Object.assign({ sanitize: true }, options);
 
@@ -339,19 +319,10 @@ function githubRequest(request, url, query, cb) {
   });
 }
 
-function constEq(a, b) {
-  if (a.length !== b.length) { return false; }
-  let zero = 0;
-  for (let i = 0; i < a.length; i++) {
-    zero |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return (zero === 0);
-}
-
 module.exports = {
   scheduleAutosaving,
   cancelAutosaving,
   request: githubRequest,
   setRoutes,
-  getTokenDebugInfo,
+  serializeDebugInfo,
 };

server.js

@@ -23,6 +23,7 @@ const { checkErrorResponse } = require('./lib/error-helper');
 const analytics = require('./lib/analytics');
 const config = require('./lib/server-config');
 const githubAuth = require('./lib/github-auth');
+const { setRoutes: setGithubAdminRoutes } = require('./services/github/auth/admin');
 const sysMonitor = require('./lib/sys/monitor');
 const log = require('./lib/log');
 const { makeMakeBadgeFn } = require('./lib/make-badge');
@@ -165,6 +166,7 @@ analytics.load();
 analytics.scheduleAutosaving();
 analytics.setRoutes(camp);
 
+setGithubAdminRoutes(camp);
 githubAuth.scheduleAutosaving({ dir: config.persistence.dir });
 if (serverSecrets && serverSecrets.gh_client_id) {
   githubAuth.setRoutes(camp);
@@ -176,7 +178,7 @@ if (serverSecrets && serverSecrets.shieldsSecret) {
 let githubDebugInterval;
 if (config.services.github.debug.enabled) {
   githubDebugInterval = setInterval(() => {
-    log(githubAuth.getTokenDebugInfo());
+    log(githubAuth.serializeDebugInfo());
   }, 1000 * config.services.github.debug.intervalSeconds);
 }
 

services/github/auth/admin.js

@@ -0,0 +1,33 @@
+'use strict';
+
+const crypto = require('crypto');
+const { serializeDebugInfo } = require('../../../lib/github-auth');
+const serverSecrets = require('../../../lib/server-secrets');
+
+function setRoutes(server) {
+  // Allow the admin to obtain the tokens for operational and debugging
+  // purposes. This could be used to:
+  //
+  // - Ensure tokens have been propagated to all servers
+  // - Debug GitHub badge failures
+  //
+  // The admin can authenticate with HTTP Basic Auth, with an empty/any
+  // username and the shields secret in the password and an empty/any
+  // password.
+  //
+  // e.g.
+  // curl -u ':very-very-secret' 'https://example.com/$github-auth/tokens'
+  server.ajax.on('github-auth/tokens', (json, end, ask) => {
+    if (!crypto.timingSafeEqual(ask.password, serverSecrets.shieldsSecret)) {
+      // An unknown entity tries to connect. Let the connection linger for a minute.
+      return setTimeout(function() {
+        end('Invalid secret.');
+      }, 10000);
+    }
+    end(serializeDebugInfo({ sanitize: false }));
+  });
+}
+
+module.exports = {
+  setRoutes,
+};