|
| 1 | +//! OBS WebSocket 5.x SHA-256 認証。 |
| 2 | +//! |
| 3 | +//! `devtools/src/obsdc/auth.ts` の Rust 移植。 |
| 4 | +//! アルゴリズムは hisui 本体の `src/obsws/auth.rs` の `build_authentication_response` と同一。 |
| 5 | +
|
| 6 | +use base64ct::{Base64, Encoding as _}; |
| 7 | + |
| 8 | +/// OBS WebSocket 5.x の認証文字列を生成する。 |
| 9 | +/// |
| 10 | +/// 1. `base64_secret = base64(sha256(password + salt))` |
| 11 | +/// 2. `authentication = base64(sha256(base64_secret + challenge))` |
| 12 | +pub fn generate_authentication_string(password: &str, salt: &str, challenge: &str) -> String { |
| 13 | + let secret_hash = aws_lc_rs::digest::digest( |
| 14 | + &aws_lc_rs::digest::SHA256, |
| 15 | + format!("{password}{salt}").as_bytes(), |
| 16 | + ); |
| 17 | + let base64_secret = Base64::encode_string(secret_hash.as_ref()); |
| 18 | + let secret_challenge_hash = aws_lc_rs::digest::digest( |
| 19 | + &aws_lc_rs::digest::SHA256, |
| 20 | + format!("{base64_secret}{challenge}").as_bytes(), |
| 21 | + ); |
| 22 | + Base64::encode_string(secret_challenge_hash.as_ref()) |
| 23 | +} |
| 24 | + |
| 25 | +#[cfg(test)] |
| 26 | +mod tests { |
| 27 | + use super::*; |
| 28 | + |
| 29 | + // ブラウザ版 auth.test.ts のテストを移植したもの |
| 30 | + |
| 31 | + #[test] |
| 32 | + fn generate_authentication_string_matches_spec() { |
| 33 | + // プロトコル仕様のサンプル値 |
| 34 | + let password = "supersecretpassword"; |
| 35 | + let salt = "lM1GncleQOaCu9lT1yeUZhFYnqhsLLP1G5lAGo3ixaI="; |
| 36 | + let challenge = "+IxH4CnCiqpX1rM9scsNynZzbOe4KhDeYcTNS3PDaeY="; |
| 37 | + |
| 38 | + let result = generate_authentication_string(password, salt, challenge); |
| 39 | + |
| 40 | + // 結果は Base64 文字列であること |
| 41 | + assert!( |
| 42 | + result |
| 43 | + .chars() |
| 44 | + .all(|c| c.is_ascii_alphanumeric() || c == '+' || c == '/' || c == '='), |
| 45 | + "Base64 文字列であること: {}", |
| 46 | + result |
| 47 | + ); |
| 48 | + // 長さは SHA-256 の Base64 エンコード (44 文字) |
| 49 | + assert_eq!(result.len(), 44); |
| 50 | + } |
| 51 | + |
| 52 | + #[test] |
| 53 | + fn generate_authentication_string_is_deterministic() { |
| 54 | + let password = "testpassword"; |
| 55 | + let salt = "testsalt"; |
| 56 | + let challenge = "testchallenge"; |
| 57 | + |
| 58 | + let result1 = generate_authentication_string(password, salt, challenge); |
| 59 | + let result2 = generate_authentication_string(password, salt, challenge); |
| 60 | + |
| 61 | + assert_eq!(result1, result2); |
| 62 | + } |
| 63 | + |
| 64 | + #[test] |
| 65 | + fn generate_authentication_string_differs_by_password() { |
| 66 | + let salt = "testsalt"; |
| 67 | + let challenge = "testchallenge"; |
| 68 | + |
| 69 | + let result1 = generate_authentication_string("password1", salt, challenge); |
| 70 | + let result2 = generate_authentication_string("password2", salt, challenge); |
| 71 | + |
| 72 | + assert_ne!(result1, result2); |
| 73 | + } |
| 74 | +} |
0 commit comments