|
|
@@ -1,13 +1,90 @@
|
|
|
use crate::schema;
|
|
|
+use serde::Deserialize;
|
|
|
use tide::http::Cookie;
|
|
|
|
|
|
#[derive(Clone)]
|
|
|
pub struct ServerState {
|
|
|
core: &'static super::ServerCoreState,
|
|
|
+ realm_cache: std::sync::Arc<std::sync::RwLock<std::collections::HashMap<String, schema::RealmID>>>
|
|
|
}
|
|
|
|
|
|
type Request = tide::Request<ServerState>;
|
|
|
|
|
|
+impl ServerState {
|
|
|
+ pub fn get_realm(&self, req: &Request) -> Option<schema::RealmID> {
|
|
|
+ let realm_str = req.param("realm").expect("get_realm called with no :realm param");
|
|
|
+ let cache = self.realm_cache.read().unwrap();
|
|
|
+ let cache_lookup = cache.get(realm_str);
|
|
|
+
|
|
|
+ // expected case
|
|
|
+ if cache_lookup.is_some() { return cache_lookup.map(|x| *x) }
|
|
|
+ drop(cache);
|
|
|
+
|
|
|
+ // unexpected case, but maybe we haven't filled that cache entry yet
|
|
|
+
|
|
|
+ let qi = self.core.pool.query_interface();
|
|
|
+ let realm = qi.get_one_by(schema::RealmColumns::Shortname, realm_str);
|
|
|
+
|
|
|
+ if let Some(with_id) = realm {
|
|
|
+ let mut cache = self.realm_cache.write().unwrap();
|
|
|
+ cache.insert(realm_str.to_owned(), with_id.id());
|
|
|
+ return Some(with_id.id())
|
|
|
+ }
|
|
|
+
|
|
|
+ // other expected case, is bogus realm
|
|
|
+ return None
|
|
|
+ }
|
|
|
+
|
|
|
+ fn build_session(
|
|
|
+ qi: µrm::QueryInterface
|
|
|
+ ) -> tide::Result<(schema::SessionID, Option<tide::http::Cookie<'static>>)> {
|
|
|
+ let rng = ring::rand::SystemRandom::new();
|
|
|
+ let session_id: [u8; 32] = ring::rand::generate(&rng)
|
|
|
+ .map_err(|_| tide::Error::from_str(500, "Failed to generate session ID"))?
|
|
|
+ .expose();
|
|
|
+ let session_id = base64::encode_config(session_id, base64::URL_SAFE_NO_PAD);
|
|
|
+
|
|
|
+ // response.insert_cookie(Cookie::new("vogt_session", session_id.clone()));
|
|
|
+
|
|
|
+ let maybe_id = qi.add(&crate::schema::Session { key: session_id.clone() });
|
|
|
+ Ok((maybe_id.ok_or(tide::Error::from_str(
|
|
|
+ 500,
|
|
|
+ "Failed to store session in database",
|
|
|
+ ))?, Some(Cookie::new("vogt_session", session_id))))
|
|
|
+ }
|
|
|
+
|
|
|
+ pub fn get_or_build_session(&self, req: &Request) -> tide::Result<(schema::SessionID, Option<tide::http::Cookie<'static>>)> {
|
|
|
+ println!("get_or_build_session()...");
|
|
|
+ let qi = self.core.pool.query_interface();
|
|
|
+ if let Some(sid) = req.cookie("vogt_session") {
|
|
|
+ println!("cookie is set ...");
|
|
|
+ let existing = qi.get_one_by(schema::SessionColumns::Key, sid.value());
|
|
|
+
|
|
|
+ if existing.is_some() {
|
|
|
+ println!("recognize the session!");
|
|
|
+ return Ok((existing.unwrap().id(), None))
|
|
|
+ }
|
|
|
+ println!("don't recognize the session {}", sid.value());
|
|
|
+ }
|
|
|
+ println!("building new session!");
|
|
|
+ Self::build_session(qi)
|
|
|
+ }
|
|
|
+
|
|
|
+ pub fn get_auth_for_session(&self, realm: schema::RealmID, session: schema::SessionID) -> Option<microrm::WithID<schema::SessionAuthentication>> {
|
|
|
+ let qi = self.core.pool.query_interface();
|
|
|
+
|
|
|
+ use schema::SessionAuthenticationColumns as SAC;
|
|
|
+ qi.get_one_by_multi(&[SAC::Realm, SAC::Session], µrm::value_list!(&realm, &session))
|
|
|
+ }
|
|
|
+
|
|
|
+ pub fn destroy_auth(&self, realm: schema::RealmID, session: schema::SessionID) {
|
|
|
+ let qi = self.core.pool.query_interface();
|
|
|
+
|
|
|
+ use schema::SessionAuthenticationColumns as SAC;
|
|
|
+ qi.delete_by_multi(&[SAC::Realm, SAC::Session], µrm::value_list!(&realm, &session));
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
async fn v1_check(req: Request) -> tide::Result<tide::Response> {
|
|
|
let validity = super::is_auth_valid(req.state().core, &req);
|
|
|
if let Some(true) = validity {
|
|
|
@@ -19,62 +96,13 @@ async fn v1_check(req: Request) -> tide::Result<tide::Response> {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-fn build_session(
|
|
|
- qi: µrm::QueryInterface,
|
|
|
- response: &mut tide::Response,
|
|
|
-) -> tide::Result<schema::SessionID> {
|
|
|
- let rng = ring::rand::SystemRandom::new();
|
|
|
- let session_id: [u8; 32] = ring::rand::generate(&rng)
|
|
|
- .map_err(|_| tide::Error::from_str(500, "Failed to generate session ID"))?
|
|
|
- .expose();
|
|
|
- let session_id = base64::encode_config(session_id, base64::URL_SAFE_NO_PAD);
|
|
|
-
|
|
|
- response.insert_cookie(Cookie::new("vogt_session", session_id.clone()));
|
|
|
-
|
|
|
- let maybe_id = qi.add(&crate::schema::Session { key: session_id });
|
|
|
- Ok(maybe_id.ok_or(tide::Error::from_str(
|
|
|
- 500,
|
|
|
- "Failed to store session in database",
|
|
|
- ))?)
|
|
|
-}
|
|
|
-
|
|
|
-fn render_login_page(state: &ServerState, mut response: tide::Response, to_present: schema::AuthChallengeType) -> tide::Response {
|
|
|
- let tmpl = state.core.templates.read().unwrap();
|
|
|
-
|
|
|
- let do_challenge = |ty,ch| {
|
|
|
- tmpl.render("id_v1_login", &serde_json::json!(
|
|
|
- {
|
|
|
- "challenge":
|
|
|
- format!(r#"
|
|
|
- <input type="hidden" name="challenge-type" value="{:?} {}" />
|
|
|
- <div class="challenge-type">{}</div>
|
|
|
- <div class="challenge-content">{}</div>
|
|
|
- "#,
|
|
|
- to_present, serde_json::to_string(&to_present).unwrap(),ty,ch)
|
|
|
- }
|
|
|
- )).unwrap()
|
|
|
- };
|
|
|
|
|
|
- response.set_content_type("text/html");
|
|
|
-
|
|
|
- match to_present {
|
|
|
- schema::AuthChallengeType::Username => {
|
|
|
- response.set_body(do_challenge("Username",
|
|
|
- r#"<input name="challenge" type="text" autofocus />"#));
|
|
|
- },
|
|
|
- schema::AuthChallengeType::Password => {
|
|
|
- response.set_body(do_challenge("Password",
|
|
|
- r#"<input name="challenge" type="password" autofocus />"#));
|
|
|
- }
|
|
|
- _ => todo!()
|
|
|
- }
|
|
|
-
|
|
|
- response
|
|
|
-}
|
|
|
-
|
|
|
-async fn v1_login(mut req: tide::Request<ServerState>) -> tide::Result<tide::Response> {
|
|
|
- let mut response = tide::Response::builder(200).build();
|
|
|
+/*
|
|
|
+fn get_session_auth(req: &tide::Request<ServerState>, response: &mut tide::Response) -> Option<microrm::WithID<schema::SessionAuthentication>> {
|
|
|
let qi = req.state().core.pool.query_interface();
|
|
|
+ let realm_name = req
|
|
|
+ .param("realm")
|
|
|
+ .expect("Failed to parse realm out of path?");
|
|
|
|
|
|
let sid: schema::SessionID = match req.cookie("vogt_session") {
|
|
|
Some(sid) => {
|
|
|
@@ -83,19 +111,13 @@ async fn v1_login(mut req: tide::Request<ServerState>) -> tide::Result<tide::Res
|
|
|
if let Some(id) = existing {
|
|
|
id.id()
|
|
|
} else {
|
|
|
- build_session(&qi, &mut response)?
|
|
|
+ build_session(&qi, response).ok()?
|
|
|
}
|
|
|
}
|
|
|
- None => build_session(&qi, &mut response)?,
|
|
|
+ None => build_session(&qi, response).ok()?,
|
|
|
};
|
|
|
|
|
|
- let realm_name = req
|
|
|
- .param("realm")
|
|
|
- .expect("Failed to parse realm out of path?");
|
|
|
-
|
|
|
- let realm_id = qi
|
|
|
- .get_one_by(schema::RealmColumns::Shortname, realm_name)
|
|
|
- .ok_or(tide::Error::from_str(404, "No such realm"))?;
|
|
|
+ let realm_id = qi.get_one_by(schema::RealmColumns::Shortname, realm_name)?;
|
|
|
|
|
|
let realm_auth = qi.get_one_by_multi(
|
|
|
&[
|
|
|
@@ -105,36 +127,185 @@ async fn v1_login(mut req: tide::Request<ServerState>) -> tide::Result<tide::Res
|
|
|
µrm::value_list!(&sid, &realm_id.id()),
|
|
|
);
|
|
|
|
|
|
+ realm_auth
|
|
|
+}
|
|
|
+*/
|
|
|
+
|
|
|
+impl ServerState {
|
|
|
+ fn render_login_from_auth(&self, response: tide::Response, auth: Option<schema::SessionAuthentication>, error_msg: Option<String>) -> tide::Response {
|
|
|
+ let to_present: Option<schema::AuthChallengeType> = match auth {
|
|
|
+ None => Some(schema::AuthChallengeType::Username),
|
|
|
+ Some(auth) => auth.challenges_left.first().copied()
|
|
|
+ };
|
|
|
+
|
|
|
+ if to_present.is_none() {
|
|
|
+ todo!("Already logged in!");
|
|
|
+ }
|
|
|
+ else {
|
|
|
+ self.render_login_page(response, to_present.unwrap(), error_msg)
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ fn render_login_page(&self, mut response: tide::Response, to_present: schema::AuthChallengeType, error_msg: Option<String>) -> tide::Response {
|
|
|
+ let tmpl = self.core.templates.read().unwrap();
|
|
|
+
|
|
|
+ let do_challenge = |ty,ch| {
|
|
|
+ tmpl.render("id_v1_login", &serde_json::json!(
|
|
|
+ {
|
|
|
+ "challenge":
|
|
|
+ format!(r#"
|
|
|
+ <input type="hidden" name="challenge_type" value="{:?}" />
|
|
|
+ <div class="challenge-type">{}</div>
|
|
|
+ <div class="challenge-content">{}</div>
|
|
|
+ "#,
|
|
|
+ to_present, ty, ch),
|
|
|
+ "error_msg": error_msg.iter().collect::<Vec<_>>()
|
|
|
+ }
|
|
|
+ )).unwrap()
|
|
|
+ };
|
|
|
+
|
|
|
+ response.set_content_type("text/html");
|
|
|
+
|
|
|
+ match to_present {
|
|
|
+ schema::AuthChallengeType::Username => {
|
|
|
+ response.set_body(do_challenge("Username",
|
|
|
+ r#"<input name="challenge" type="text" autofocus />"#));
|
|
|
+ },
|
|
|
+ schema::AuthChallengeType::Password => {
|
|
|
+ response.set_body(do_challenge("Password",
|
|
|
+ r#"<input name="challenge" type="password" autofocus />"#));
|
|
|
+ },
|
|
|
+ _ => todo!()
|
|
|
+ }
|
|
|
+
|
|
|
+ response
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
+async fn v1_login(req: tide::Request<ServerState>) -> tide::Result<tide::Response> {
|
|
|
+ let mut response = tide::Response::builder(200).build();
|
|
|
+
|
|
|
+ // let qi = req.state().core.pool.query_interface();
|
|
|
+
|
|
|
+ let realm = req.state().get_realm(&req).ok_or(tide::Error::from_str(404, "No such realm"))?;
|
|
|
+ let (session_id, cookie) = req.state().get_or_build_session(&req)?;
|
|
|
+ cookie.map(|c| response.insert_cookie(c));
|
|
|
+
|
|
|
+ let auth = req.state().get_auth_for_session(realm, session_id);
|
|
|
+
|
|
|
+ Ok(req.state().render_login_from_auth(response, auth.map(|a| a.wrapped()), None))
|
|
|
+
|
|
|
+ /*let realm_auth = get_session_auth(&req, &mut response);
|
|
|
+
|
|
|
let to_present: Option<schema::AuthChallengeType> = match realm_auth {
|
|
|
None => Some(schema::AuthChallengeType::Username),
|
|
|
Some(auth) => auth.challenges_left.first().map(|x| *x),
|
|
|
};
|
|
|
|
|
|
if to_present.is_some() {
|
|
|
- Ok(render_login_page(req.state(), response, to_present.unwrap()))
|
|
|
+ Ok(render_login_page(req.state(), response, to_present.unwrap(), None))
|
|
|
}
|
|
|
else {
|
|
|
// already logged in...
|
|
|
todo!()
|
|
|
- }
|
|
|
+ }*/
|
|
|
}
|
|
|
|
|
|
async fn v1_login_response(mut req: tide::Request<ServerState>) -> tide::Result<tide::Response> {
|
|
|
- todo!()
|
|
|
+ let mut response = tide::Response::builder(200).build();
|
|
|
+
|
|
|
+ let realm = req.state().get_realm(&req).ok_or(tide::Error::from_str(404, "No such realm"))?;
|
|
|
+ let (session_id, cookie) = req.state().get_or_build_session(&req)?;
|
|
|
+ cookie.map(|c| response.insert_cookie(c));
|
|
|
+
|
|
|
+ let mut auth = req.state().get_auth_for_session(realm, session_id);
|
|
|
+
|
|
|
+ #[derive(Deserialize)]
|
|
|
+ struct ResponseBody {
|
|
|
+ challenge_type: String,
|
|
|
+ challenge: String
|
|
|
+ }
|
|
|
+
|
|
|
+ let body : ResponseBody = req.body_form().await?;
|
|
|
+
|
|
|
+ use schema::AuthChallengeType as ChallengeType;
|
|
|
+
|
|
|
+ let challenge: schema::AuthChallengeType = match body.challenge_type.as_str() {
|
|
|
+ "Username" => ChallengeType::Username,
|
|
|
+ "Password" => ChallengeType::Password,
|
|
|
+ _ => Err(tide::Error::from_str(400, "Unknown challenge type"))?
|
|
|
+ };
|
|
|
+
|
|
|
+ let mut error = None;
|
|
|
+
|
|
|
+ // check that the response matches what we're expecting next
|
|
|
+ let to_be_presented: Option<schema::AuthChallengeType> = match &auth {
|
|
|
+ None => Some(schema::AuthChallengeType::Username),
|
|
|
+ Some(auth) => auth.challenges_left.first().copied()
|
|
|
+ };
|
|
|
+
|
|
|
+ if to_be_presented != Some(challenge) {
|
|
|
+ Err(tide::Error::from_str(400, "Incorrect challenge type"))?
|
|
|
+ }
|
|
|
+
|
|
|
+ match challenge {
|
|
|
+ ChallengeType::Username => {
|
|
|
+ let qi = req.state().core.pool.query_interface();
|
|
|
+ req.state().destroy_auth(realm, session_id);
|
|
|
+
|
|
|
+ let user = qi.get_one_by_multi(&[schema::UserColumns::Realm, schema::UserColumns::Username], µrm::value_list![&realm, &body.challenge]);
|
|
|
+ if user.is_none() {
|
|
|
+ error = Some(format!("No such user {}", body.challenge));
|
|
|
+ }
|
|
|
+ else {
|
|
|
+ let user = user.unwrap();
|
|
|
+
|
|
|
+ let sa = schema::SessionAuthentication { session: session_id, realm: realm, user: user.id(), challenges_left: vec![schema::AuthChallengeType::Password] };
|
|
|
+ let id = qi.add(&sa).unwrap();
|
|
|
+ auth = Some(microrm::WithID::new(sa, id));
|
|
|
+ }
|
|
|
+ // req.state().destroy_auth(realm, session_id);
|
|
|
+
|
|
|
+ },
|
|
|
+ ChallengeType::Password => {
|
|
|
+ if auth.is_none() {
|
|
|
+ error = Some(format!("Please restart login process."));
|
|
|
+ }
|
|
|
+ else {
|
|
|
+ let qi = req.state().core.pool.query_interface();
|
|
|
+
|
|
|
+ use schema::AuthChallengeColumns;
|
|
|
+ let challenge = qi.get_one_by_multi(&[AuthChallengeColumns::User, AuthChallengeColumns::ChallengeType], µrm::value_list![&auth.as_ref().unwrap().user, &schema::AuthChallengeType::Password]);
|
|
|
+
|
|
|
+ if challenge.is_none() {
|
|
|
+ error = Some(format!("User lacks a password. Please contact an administrator."));
|
|
|
+ }
|
|
|
+ else {
|
|
|
+ use ring::pbkdf2;
|
|
|
+
|
|
|
+ let challenge = challenge.unwrap();
|
|
|
+
|
|
|
+ let verification = pbkdf2::verify(pbkdf2::PBKDF2_HMAC_SHA256, std::num::NonZeroU32::new(20000).unwrap(), challenge.public.as_slice(), body.challenge.as_bytes(), challenge.secret.as_slice());
|
|
|
+
|
|
|
+ if verification.is_ok() {
|
|
|
+ auth.as_mut().unwrap().challenges_left.remove(0);
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ },
|
|
|
+ _ => todo!()
|
|
|
+ };
|
|
|
+
|
|
|
+ Ok(req.state().render_login_from_auth(response, auth.map(|a| a.wrapped()), error))
|
|
|
}
|
|
|
|
|
|
pub fn id_v1_server(core: &'static super::ServerCoreState) -> tide::Server<ServerState> {
|
|
|
- let mut srv = tide::with_state(ServerState { core });
|
|
|
+ let mut srv = tide::with_state(ServerState { core, realm_cache: std::sync::Arc::new(std::sync::RwLock::new(std::collections::HashMap::new())) });
|
|
|
|
|
|
srv.with(tide::log::LogMiddleware::new());
|
|
|
|
|
|
srv.at("login").get(v1_login).post(v1_login_response);
|
|
|
srv.at("check").get(v1_check).head(v1_check);
|
|
|
|
|
|
- // load and register templates
|
|
|
- core.templates.write().unwrap()
|
|
|
- .register_template_file("id_v1_login", "srv/login.html")
|
|
|
- .expect("Couldn't register template!");
|
|
|
-
|
|
|
srv
|
|
|
}
|
