From 49bfe6ab74229ba4da5342382b87dcd6fca239fa Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Mon, 19 Nov 2012 15:58:46 +0100
Subject: works - but not quite what i want. Exposing jqXHR to error function

---
 src/jqueryRest.js | 23 +++++++++++------------
 src/srp.js        | 27 ++++++++++++++++-----------
 2 files changed, 27 insertions(+), 23 deletions(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index 54a0908..a7928d5 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -1,31 +1,30 @@
 jqueryRest = function() {
 
   // we do not fetch the salt from the server
-  function register(session, callback)
+  function register(session)
   {
-    sendVerifier(session, callback);
+    return sendVerifier(session);
   }
 
-  function sendVerifier(session, callback) {
+  function sendVerifier(session) {
     var salt = session.getSalt();
-    $.post("users.json", { user:
+    return $.post("users.json", { user:
       { login: session.getI(),
         password_salt: salt,
-        password_verifier: session.getV(salt).toString(16)}
-    }, callback);
+        password_verifier: session.getV(salt).toString(16)
+      }
+    });
   }
 
-  function handshake(session, callback) {
-    $.post("sessions.json", { login: session.getI(),
-      A: session.getAstr()}, callback);
+  function handshake(session) {
+    return $.post("sessions.json", { login: session.getI(), A: session.getAstr()});
   }
 
-  function authenticate(session, success) {
-    $.ajax({
+  function authenticate(session) {
+    return $.ajax({
       url: "sessions/" + session.getI() + ".json",
       type: 'PUT',
       data: {client_auth: session.getM()},
-      success: success
     });
   }
 
diff --git a/src/srp.js b/src/srp.js
index 6d1e8c1..6a377ce 100644
--- a/src/srp.js
+++ b/src/srp.js
@@ -2,8 +2,6 @@ function SRP(remote, session)
 {
   var srp = this;
   session = session || new this.Session();
-  remote = remote || new this.Remote();
-  remote.onError = remote.onError || this.error;
   session.onError = session.onError || this.error;
   this.remote = remote;
   this.session = session;
@@ -12,7 +10,9 @@ function SRP(remote, session)
   this.identify = function(success, error)
   {
     store_callbacks(success, error);
-    remote.handshake(session, receive_salts);
+    remote.handshake(session)
+    .success(receive_salts)
+    .error(srp.error);
 
     // Receive login salts from the server, start calculations
     function receive_salts(response)
@@ -28,7 +28,9 @@ function SRP(remote, session)
       else 
       {
         session.calculations(response.salt, response.B);
-        remote.authenticate(session, confirm_authentication);
+        remote.authenticate(session)
+        .success(confirm_authentication)
+        .error(srp.error);
       }
     }
 
@@ -47,12 +49,15 @@ function SRP(remote, session)
   this.register = function(success, error)
   {
     store_callbacks(success, error);
-    remote.register(session, srp.registered_user);
+    remote.register(session)
+    .success(srp.registered_user)
+    .error(srp.error);
   };
 
   // The user has been registered successfully, now login
   this.registered_user = function(response)
   {
+    // TODO: This can go if response has an error code
     if(response.errors) {
       srp.error(response.errors)
     }
@@ -61,12 +66,6 @@ function SRP(remote, session)
     }
   };  
 
-  // Minimal error handling - set remote.onError to sth better to overwrite.
-  this.error = function(text)
-  {
-    alert(text);
-  };
-
   // This function is called when authentication is successful.
   // It's a dummy. Please hand the real thing to the call to identify.
   this.success = function()
@@ -74,6 +73,12 @@ function SRP(remote, session)
     alert("Login successful.");
   };
 
+  // Minimal error handling - set remote.onError to sth better to overwrite.
+  this.error = function(text)
+  {
+    alert(text);
+  };
+
   function store_callbacks(success, error) {
     if (typeof success == "function") {
       srp.success = success;
-- 
cgit v1.2.3


From 2e365cba5263ec50f10fb074c054ef19adb8f7b0 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Mon, 19 Nov 2012 17:36:49 +0100
Subject: first step at cleaning up the srp

---
 src/jqueryRest.js | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 src/srp.js        | 19 +++++++++++++++++++
 2 files changed, 69 insertions(+)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index a7928d5..29f737c 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -35,3 +35,53 @@ jqueryRest = function() {
     authenticate: authenticate
   };
 };
+
+srp.remote = (function(){
+
+  function signup(){
+    jqueryRest().register(srp.session)
+    .success(srp.signedUp)
+    .error(srp.error)
+  };
+
+  function login(){
+    jqueryRest().handshake(srp.session)
+    .success(receiveSalts)
+    .error(srp.error)
+  };
+
+  function receiveSalts(response){
+    // B = 0 will make the algorithm always succeed
+    // -> refuse such a server answer
+    if(response.B === 0) {
+      srp.error("Server send random number 0 - could not login.");
+    }
+    else if(! response.salt || response.salt === 0) {
+      srp.error("Server failed to send salt - could not login.");
+    } 
+    else 
+    {
+      srp.session.calculations(response.salt, response.B);
+      jqueryRest().authenticate(srp.session)
+      .success(confirmAuthentication)
+      .error(srp.error);
+    }
+  };
+
+  // Receive M2 from the server and verify it
+  // If an error occurs, raise it as an alert.
+  function confirmAuthentication(response)
+  {
+    if (srp.session.validate(response.M2))
+      srp.loggedIn();
+    else
+      srp.error("Server key does not match");
+  };
+
+
+  return {
+    signup: signup,
+    login: login
+  }
+
+}());
diff --git a/src/srp.js b/src/srp.js
index 6a377ce..5b76a88 100644
--- a/src/srp.js
+++ b/src/srp.js
@@ -1,3 +1,22 @@
+var srp = (function(){
+
+  function signup()
+  {
+    this.remote.signup();
+  };
+
+  function login()
+  {
+    this.remote.login();
+  };
+
+  return {
+    signup: signup,
+    login: login
+  }
+}());
+
+
 function SRP(remote, session)
 {
   var srp = this;
-- 
cgit v1.2.3


From a41d7f306aa1dbcae17643cc9c3b457632ee8909 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Mon, 19 Nov 2012 17:49:18 +0100
Subject: removed the SRP class - using just a plain srp object now

---
 src/srp.js         | 92 ------------------------------------------------------
 src/srp_session.js |  5 ++-
 2 files changed, 2 insertions(+), 95 deletions(-)

(limited to 'src')

diff --git a/src/srp.js b/src/srp.js
index 5b76a88..e57b7e9 100644
--- a/src/srp.js
+++ b/src/srp.js
@@ -16,95 +16,3 @@ var srp = (function(){
   }
 }());
 
-
-function SRP(remote, session)
-{
-  var srp = this;
-  session = session || new this.Session();
-  session.onError = session.onError || this.error;
-  this.remote = remote;
-  this.session = session;
-
-  // Start the login process by identifying the user
-  this.identify = function(success, error)
-  {
-    store_callbacks(success, error);
-    remote.handshake(session)
-    .success(receive_salts)
-    .error(srp.error);
-
-    // Receive login salts from the server, start calculations
-    function receive_salts(response)
-    {
-      // B = 0 will make the algorithm always succeed
-      // -> refuse such a server answer
-      if(response.B === 0) {
-        srp.error("Server send random number 0 - could not login.");
-      }
-      else if(! response.salt || response.salt === 0) {
-        srp.error("Server failed to send salt - could not login.");
-      } 
-      else 
-      {
-        session.calculations(response.salt, response.B);
-        remote.authenticate(session)
-        .success(confirm_authentication)
-        .error(srp.error);
-      }
-    }
-
-    // Receive M2 from the server and verify it
-    // If an error occurs, raise it as an alert.
-    function confirm_authentication(response)
-    {
-      if (session.validate(response.M2))
-        srp.success();
-      else
-        srp.error("Server key does not match");
-    };
-  };
-
-  // Initiate the registration process
-  this.register = function(success, error)
-  {
-    store_callbacks(success, error);
-    remote.register(session)
-    .success(srp.registered_user)
-    .error(srp.error);
-  };
-
-  // The user has been registered successfully, now login
-  this.registered_user = function(response)
-  {
-    // TODO: This can go if response has an error code
-    if(response.errors) {
-      srp.error(response.errors)
-    }
-    else {
-      srp.identify();
-    }
-  };  
-
-  // This function is called when authentication is successful.
-  // It's a dummy. Please hand the real thing to the call to identify.
-  this.success = function()
-  {
-    alert("Login successful.");
-  };
-
-  // Minimal error handling - set remote.onError to sth better to overwrite.
-  this.error = function(text)
-  {
-    alert(text);
-  };
-
-  function store_callbacks(success, error) {
-    if (typeof success == "function") {
-      srp.success = success;
-    }
-    if (typeof error == "function") {
-      srp.error = error;
-    }
-  }
-};
-
diff --git a/src/srp_session.js b/src/srp_session.js
index 8f45a44..7f1232f 100644
--- a/src/srp_session.js
+++ b/src/srp_session.js
@@ -1,4 +1,4 @@
-SRP.prototype.Session = function(login, password) {
+srp.Session = function(login, password) {
   
   // Variables session will be used in the SRP protocol
   var Nstr = "eeaf0ab9adb38dd69c33f80afa8fc5e86072618775ff3c0b9ea2314c9c256576d674df7496ea81d3383b4813d692c6e0e0d5d8e250b98be48e495c1d6089dad15dc7d7b46154d6b6ce8ef4ad69b15d4982559b297bcf1885c529f566660e57ec68edbc3c05726cc02fd4cbf4976eaa9afd5138fe8376435b9fc61d2fc0eb06e3";
@@ -154,6 +154,5 @@ SRP.prototype.Session = function(login, password) {
     }
     return str;
   }
+};
 
-
-}
-- 
cgit v1.2.3


From 082f859bbdaedf4f03eb85aea9b8f88ffda2fe6d Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Mon, 19 Nov 2012 18:11:20 +0100
Subject: further cleanup

---
 src/jqueryRest.js  | 62 ++++++++++++++++++++++--------------------------------
 src/srp_session.js | 16 ++++++++++++++
 2 files changed, 41 insertions(+), 37 deletions(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index 29f737c..c439f67 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -1,51 +1,39 @@
-jqueryRest = function() {
-
-  // we do not fetch the salt from the server
-  function register(session)
-  {
-    return sendVerifier(session);
-  }
+srp.remote = (function(){
+  var jqueryRest = (function() {
 
-  function sendVerifier(session) {
-    var salt = session.getSalt();
-    return $.post("users.json", { user:
-      { login: session.getI(),
-        password_salt: salt,
-        password_verifier: session.getV(salt).toString(16)
-      }
-    });
-  }
+    // we do not fetch the salt from the server
+    function register(session) {
+      return $.post("users.json", { user: session.signup() });
+    }
 
-  function handshake(session) {
-    return $.post("sessions.json", { login: session.getI(), A: session.getAstr()});
-  }
+    function handshake(session) {
+      return $.post("sessions.json", session.handshake());
+    }
 
-  function authenticate(session) {
-    return $.ajax({
-      url: "sessions/" + session.getI() + ".json",
-      type: 'PUT',
-      data: {client_auth: session.getM()},
-    });
-  }
+    function authenticate(session) {
+      return $.ajax({
+        url: "sessions/" + session.getI() + ".json",
+        type: 'PUT',
+        data: {client_auth: session.getM()}
+      });
+    }
 
-  return {
-    register: register,
-    register_send_verifier: sendVerifier,
-    handshake: handshake,
-    authenticate: authenticate
-  };
-};
+    return {
+      register: register,
+      handshake: handshake,
+      authenticate: authenticate
+    };
+  }());
 
-srp.remote = (function(){
 
   function signup(){
-    jqueryRest().register(srp.session)
+    jqueryRest.register(srp.session)
     .success(srp.signedUp)
     .error(srp.error)
   };
 
   function login(){
-    jqueryRest().handshake(srp.session)
+    jqueryRest.handshake(srp.session)
     .success(receiveSalts)
     .error(srp.error)
   };
@@ -62,7 +50,7 @@ srp.remote = (function(){
     else 
     {
       srp.session.calculations(response.salt, response.B);
-      jqueryRest().authenticate(srp.session)
+      jqueryRest.authenticate(srp.session)
       .success(confirmAuthentication)
       .error(srp.error);
     }
diff --git a/src/srp_session.js b/src/srp_session.js
index 7f1232f..b278993 100644
--- a/src/srp_session.js
+++ b/src/srp_session.js
@@ -35,6 +35,22 @@ srp.Session = function(login, password) {
     return Astr;
   };
 
+  this.signup = function() {
+    var salt = this.getSalt();
+    return {
+      login: this.getI(),
+      password_salt: salt,
+      password_verifier: this.getV(salt).toString(16)
+    };
+  };
+
+  this.handshake = function() {
+    return { 
+      login: this.getI(), 
+      A: this.getAstr()
+    };
+  };
+
   this.getAstr = function() {
     return Astr;
   }
-- 
cgit v1.2.3


From cb46537c98db3cb7ac8cf23de243a86aa4a36acd Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Tue, 20 Nov 2012 10:52:45 +0100
Subject: sending the parsed json object to the error handler

---
 src/jqueryRest.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index c439f67..c4b0161 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -29,13 +29,13 @@ srp.remote = (function(){
   function signup(){
     jqueryRest.register(srp.session)
     .success(srp.signedUp)
-    .error(srp.error)
+    .error(error)
   };
 
   function login(){
     jqueryRest.handshake(srp.session)
     .success(receiveSalts)
-    .error(srp.error)
+    .error(error)
   };
 
   function receiveSalts(response){
@@ -52,7 +52,7 @@ srp.remote = (function(){
       srp.session.calculations(response.salt, response.B);
       jqueryRest.authenticate(srp.session)
       .success(confirmAuthentication)
-      .error(srp.error);
+      .error(error);
     }
   };
 
@@ -66,6 +66,12 @@ srp.remote = (function(){
       srp.error("Server key does not match");
   };
 
+  // The server will send error messages as json alongside
+  // the http error response.
+  function error(xhr)
+  { 
+    srp.error($.parseJSON(xhr.responseText))
+  };
 
   return {
     signup: signup,
-- 
cgit v1.2.3


From 6a1f447f4155796ca9b2510c49f52559b3934c17 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Tue, 20 Nov 2012 12:25:17 +0100
Subject: make sure srp.login also works as a callback

---
 src/srp.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/srp.js b/src/srp.js
index e57b7e9..c754818 100644
--- a/src/srp.js
+++ b/src/srp.js
@@ -2,12 +2,12 @@ var srp = (function(){
 
   function signup()
   {
-    this.remote.signup();
+    srp.remote.signup();
   };
 
   function login()
   {
-    this.remote.login();
+    srp.remote.login();
   };
 
   return {
-- 
cgit v1.2.3


From 443a9d3aa5e66f98d7f701e04967620781f3012c Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Tue, 20 Nov 2012 12:37:23 +0100
Subject: make sure we get the current password and login

---
 src/srp_session.js | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/srp_session.js b/src/srp_session.js
index b278993..cfeaadb 100644
--- a/src/srp_session.js
+++ b/src/srp_session.js
@@ -21,8 +21,8 @@ srp.Session = function(login, password) {
   var M = null;
   var M2 = null;
   var authenticated = false;
-  var I = login || document.getElementById("srp_username").value;
-  var pass = password || document.getElementById("srp_password").value;
+  var I = login;
+  var pass = password;
 
   // *** Accessor methods ***
 
@@ -57,9 +57,16 @@ srp.Session = function(login, password) {
 
   // Returns the user's identity
   this.getI = function() {
+    I = I || document.getElementById("srp_username").value;
     return I;
   };
 
+  // Returns the user's identity
+  this.getPass = function() {
+    pass = pass || document.getElementById("srp_password").value;
+    return pass;
+  };
+
   // some 16 byte random number
   this.getSalt = function() {
     return new BigInteger(64, rng).toString(16);
@@ -77,7 +84,8 @@ srp.Session = function(login, password) {
 
   // Calculates the X value and return it as a BigInteger
   this.calcX = function(salt) {
-    return new BigInteger(SHA256(hex2a(salt + SHA256(I + ":" + pass))), 16);
+    var inner = salt + SHA256(this.getI() + ":" + this.getPass())
+    return new BigInteger(SHA256(hex2a(inner)), 16);
   };
 
   this.getV = function(salt)
-- 
cgit v1.2.3


From 635ea47f1c19d7985a8f5107c070ae19edf9dd54 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Tue, 20 Nov 2012 12:43:34 +0100
Subject: all request should go to absolute paths

They should be independent of the url we're serving the page from
---
 src/jqueryRest.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index c4b0161..1a60385 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -3,16 +3,16 @@ srp.remote = (function(){
 
     // we do not fetch the salt from the server
     function register(session) {
-      return $.post("users.json", { user: session.signup() });
+      return $.post("/users.json", { user: session.signup() });
     }
 
     function handshake(session) {
-      return $.post("sessions.json", session.handshake());
+      return $.post("/sessions.json", session.handshake());
     }
 
     function authenticate(session) {
       return $.ajax({
-        url: "sessions/" + session.getI() + ".json",
+        url: "/sessions/" + session.getI() + ".json",
         type: 'PUT',
         data: {client_auth: session.getM()}
       });
-- 
cgit v1.2.3


From ac5e8d8aa7d4a69a20e20d3079691d13ed2faa66 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Thu, 22 Nov 2012 12:49:46 +0100
Subject: using done/fail instead of success/error, handing all properties to
 fail

---
 src/jqueryRest.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index 1a60385..20692e9 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -28,14 +28,14 @@ srp.remote = (function(){
 
   function signup(){
     jqueryRest.register(srp.session)
-    .success(srp.signedUp)
-    .error(error)
+    .done(srp.signedUp)
+    .fail(error)
   };
 
   function login(){
     jqueryRest.handshake(srp.session)
-    .success(receiveSalts)
-    .error(error)
+    .done(receiveSalts)
+    .fail(error)
   };
 
   function receiveSalts(response){
@@ -51,8 +51,8 @@ srp.remote = (function(){
     {
       srp.session.calculations(response.salt, response.B);
       jqueryRest.authenticate(srp.session)
-      .success(confirmAuthentication)
-      .error(error);
+      .done(confirmAuthentication)
+      .fail(error);
     }
   };
 
@@ -68,7 +68,7 @@ srp.remote = (function(){
 
   // The server will send error messages as json alongside
   // the http error response.
-  function error(xhr)
+  function error(xhr, text, thrown)
   { 
     srp.error($.parseJSON(xhr.responseText))
   };
-- 
cgit v1.2.3


From 61ab6195768e78f1378caca7ca8ef4e7adcaebb3 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Thu, 22 Nov 2012 12:56:12 +0100
Subject: catch empty responses

---
 src/jqueryRest.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index 20692e9..bc3bb51 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -70,7 +70,10 @@ srp.remote = (function(){
   // the http error response.
   function error(xhr, text, thrown)
   { 
-    srp.error($.parseJSON(xhr.responseText))
+    if (xhr.responseText && xhr.responseText != "")
+      srp.error($.parseJSON(xhr.responseText));
+    else
+      srp.error("Server did not respond.");
   };
 
   return {
-- 
cgit v1.2.3


From 076d6e251e4caf826787d87b11434e535960455c Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Thu, 22 Nov 2012 13:01:22 +0100
Subject: don't cache password and login

---
 src/srp_session.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/srp_session.js b/src/srp_session.js
index cfeaadb..3f27e3e 100644
--- a/src/srp_session.js
+++ b/src/srp_session.js
@@ -57,13 +57,13 @@ srp.Session = function(login, password) {
 
   // Returns the user's identity
   this.getI = function() {
-    I = I || document.getElementById("srp_username").value;
+    I = login || document.getElementById("srp_username").value;
     return I;
   };
 
-  // Returns the user's identity
+  // Returns the password currently typed in
   this.getPass = function() {
-    pass = pass || document.getElementById("srp_password").value;
+    pass = password || document.getElementById("srp_password").value;
     return pass;
   };
 
-- 
cgit v1.2.3


From 32719dee1d9a4d6ce717eef948dedd54f77b288b Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Fri, 23 Nov 2012 15:33:33 +0100
Subject: addToForm: add the srp signup data to an existing form

---
 src/jqueryRest.js | 14 ++++++++++++++
 src/srp.js        |  8 +++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index bc3bb51..abc53d4 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -18,6 +18,9 @@ srp.remote = (function(){
       });
     }
 
+    function addSignupToForm(session) {
+    }
+
     return {
       register: register,
       handshake: handshake,
@@ -38,6 +41,17 @@ srp.remote = (function(){
     .fail(error)
   };
 
+  function addToForm(){
+    form = this.target;
+    $.each(srp.session.signup(), function(key, value) {
+      form.append($('<input/>', {
+        type: 'hidden',
+        name: key
+        value: value
+      }));
+    }
+  }
+
   function receiveSalts(response){
     // B = 0 will make the algorithm always succeed
     // -> refuse such a server answer
diff --git a/src/srp.js b/src/srp.js
index c754818..cbfdd10 100644
--- a/src/srp.js
+++ b/src/srp.js
@@ -10,9 +10,15 @@ var srp = (function(){
     srp.remote.login();
   };
 
+  function addToForm()
+  {
+    srp.remote.addToForm();
+  };
+
   return {
     signup: signup,
-    login: login
+    login: login,
+    addToForm: addToForm
   }
 }());
 
-- 
cgit v1.2.3


From fff770a866b44abce6fe0fc5d5ffde034225436d Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Sun, 25 Nov 2012 12:55:00 +0100
Subject: API: update instead of addToForm

addToForm was an attempt to not use ajax but just the normal form submit.

Turns out it's easy to add hidden fields to the form but quite cumbersome to remove the password fields from teh form so they are not submitted over the eventually untrusted channel.

So we use ajax for updates just like for signup.
---
 src/jqueryRest.js | 35 +++++++++++++++++++----------------
 src/srp.js        |  8 ++++----
 2 files changed, 23 insertions(+), 20 deletions(-)

(limited to 'src')

diff --git a/src/jqueryRest.js b/src/jqueryRest.js
index abc53d4..bfa4592 100644
--- a/src/jqueryRest.js
+++ b/src/jqueryRest.js
@@ -1,9 +1,17 @@
 srp.remote = (function(){
   var jqueryRest = (function() {
 
-    // we do not fetch the salt from the server
+    // TODO: Do we need to differentiate between PUT and POST?
     function register(session) {
-      return $.post("/users.json", { user: session.signup() });
+      return $.post("/users.json", {user: session.signup() });
+    }
+
+    function update(url, session) {
+      return $.ajax({
+        url: url,
+        type: 'PUT',
+        data: {user: session.signup() }
+      });
     }
 
     function handshake(session) {
@@ -18,11 +26,9 @@ srp.remote = (function(){
       });
     }
 
-    function addSignupToForm(session) {
-    }
-
     return {
       register: register,
+      update: update,
       handshake: handshake,
       authenticate: authenticate
     };
@@ -35,23 +41,19 @@ srp.remote = (function(){
     .fail(error)
   };
 
+  function update(submitEvent){
+    var form = submitEvent.target;
+    jqueryRest.update(form.action, srp.session)
+    .done(srp.updated)
+    .fail(error)
+  };
+
   function login(){
     jqueryRest.handshake(srp.session)
     .done(receiveSalts)
     .fail(error)
   };
 
-  function addToForm(){
-    form = this.target;
-    $.each(srp.session.signup(), function(key, value) {
-      form.append($('<input/>', {
-        type: 'hidden',
-        name: key
-        value: value
-      }));
-    }
-  }
-
   function receiveSalts(response){
     // B = 0 will make the algorithm always succeed
     // -> refuse such a server answer
@@ -92,6 +94,7 @@ srp.remote = (function(){
 
   return {
     signup: signup,
+    update: update,
     login: login
   }
 
diff --git a/src/srp.js b/src/srp.js
index cbfdd10..efd50d2 100644
--- a/src/srp.js
+++ b/src/srp.js
@@ -10,15 +10,15 @@ var srp = (function(){
     srp.remote.login();
   };
 
-  function addToForm()
+  function update(submitEvent)
   {
-    srp.remote.addToForm();
+    srp.remote.update(submitEvent);
   };
 
   return {
     signup: signup,
-    login: login,
-    addToForm: addToForm
+    update: update,
+    login: login
   }
 }());
 
-- 
cgit v1.2.3


From 3f37e98acca731e9272848dea77b7a64a5ed7615 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Wed, 20 Mar 2013 12:49:34 +0100
Subject: use a proper random a for the handshake

---
 src/srp_session.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/srp_session.js b/src/srp_session.js
index 3f27e3e..b1b6014 100644
--- a/src/srp_session.js
+++ b/src/srp_session.js
@@ -7,8 +7,7 @@ srp.Session = function(login, password) {
   var k = new BigInteger("bf66c44a428916cad64aa7c679f3fd897ad4c375e9bbb4cbf2f5de241d618ef0", 16);
 
   var rng = new SecureRandom();
-//  var a = new BigInteger(32, rng);
-  var a = new BigInteger("d498c3d024ec17689b5320e33fc349a3f3f91320384155b3043fa410c90eab71", 16);
+  var a = new BigInteger(32, rng);
   var A = g.modPow(a, N);
   while(A.mod(N) == 0)
   {
-- 
cgit v1.2.3