Coverage / crates/hub/src/web/session.rs 88.9%

fn safe_next(next: Option<String>) -> String {

    match next {

        Some(n) if n.starts_with('/') && !n.starts_with("//") => n,

        _ => "/".into(),

}

pub async fn login_form(State(app): State<Shared>, viewer: Viewer, Query(q): Query<NextQuery>) -> Response {

    if viewer.signed_in() {

    }

    let reset = q.reset.is_some();

    let providers = super::signin::buttons(&app).await;

    Page(LoginPage {

        shell: Shell::new(&app, "/login", &viewer),

        error: q.error,

        next: safe_next(q.next),

        totp_for: None,

        pending: String::new(),

        reset,

        providers,

        approval: None,

        phones: false,

    })

    .into_response()

}

pub async fn login(

    State(app): State<Shared>,

    viewer: Viewer,

    headers: axum::http::HeaderMap,

    extensions: axum::http::Extensions,

    Form(f): Form<LoginForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/login", &viewer);

    let next = safe_next(Some(f.next.clone()));

    let username = f.username.trim().to_string();

    let account = accounts::account_by_name(&app.db, &username).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let now_ms = db::now_ms();

    let proven = !f.pending.is_empty()

        && account.as_ref().is_some_and(|a| auth::pending_login_ok(&app.cookie_key, &a.username, &a.session_salt, &f.pending, now_ms));

    let pending = account

        .as_ref()

        .map(|a| auth::pending_login(&app.cookie_key, &a.username, &a.session_salt, now_ms + PENDING_LOGIN_MS))

        .unwrap_or_default();

    let phones = match &account {

        Some(a) if a.totp_secret.is_some() => {

            !db::approvals::authenticators(&app.db, a.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_empty()

        _ => false,

    let fail = |msg: &str, totp_for: Option<String>| {

            shell: shell.clone(),

            error: (!msg.is_empty()).then(|| msg.into()),

            next: next.clone(),

            totp_for,

            pending: pending.clone(),

            providers: vec![],

            approval: None,

            phones,

        .into_response()

    };

    let addr = crate::api::client_addr(&app, &headers, &extensions);

    let keys = [Key::account("login", &username), Key::address("login", &addr)];

    if let Some(wait) = app.throttle.lock().unwrap().wait(&keys, now_ms) {

        return Ok(fail(&throttle::message(wait), proven.then(|| username.clone())));

    }

    let failed = |app: &Shared| {

        let wait = app.throttle.lock().unwrap().failed(&keys, now_ms);

        let (app, username, addr) = (app.clone(), username.clone(), addr.clone());

        async move {

            if let Some(wait) = wait {

                let detail = format!("from {} for {}s", if addr.is_empty() { "an unknown address" } else { &addr }, wait / 1000);

                accounts::audit(&app.db, None, "login.throttled", &username, &detail).await.ok();

            }

        }

    };

    if !f.pending.is_empty() && !proven {

        return Ok(fail("That took too long: sign in again.", None));

    }

    let Some(account) = account.filter(|a| proven || auth::verify_password(&a.password_hash, &f.password)) else {

        accounts::audit(&app.db, None, "login.failed", &username, "").await.ok();

        failed(&app).await;

        return Ok(fail("Wrong username or password.", None));

    if account.banned {

    }

    if account.disabled {

        accounts::audit(&app.db, None, "login.disabled", &username, "").await.ok();

        return Ok(fail("Your account has been disabled. Contact the hub's administrator.", None));

    }

    if let Some(secret) = &account.totp_secret {

        if f.code.trim().is_empty() {

            if !f.use_code.is_empty() {

                return Ok(fail("", Some(username)));

            }

            if !f.approval.is_empty() {

                if !db::approvals::take(&app.db, &f.approval, account.id).await.map_err(|e| Error::from_db(shell.clone(), e))? {

                    return Ok(fail("Your phone has not approved this sign-in. Try again, or use a code.", Some(username)));

                }

                app.throttle.lock().unwrap().cleared(&keys[0]);

                accounts::audit(&app.db, Some(&account), "login", &username, "approved on a phone").await.ok();

                return Ok(signed_in(&app, &account, &next).await);

            }

            if phones {

                let agent = headers.get(header::USER_AGENT).and_then(|v| v.to_str().ok()).unwrap_or("");

                let from = if addr.is_empty() { String::new() } else { format!(", {addr}") };

                let what = format!("Sign in from {}{from}", super::settings::browser_of(agent));

                let a =

                    crate::auth::phone::ask(&app, &account, "signin", &what, None).await.map_err(|e| Error::from_db(shell.clone(), e))?;

                return Ok(Page(LoginPage {

                    shell: shell.clone(),

                    error: None,

                    next: next.clone(),

                    totp_for: Some(username),

                    pending: pending.clone(),

                    reset: false,

                    providers: vec![],

                    approval: Some((a.id, a.number)),

                    phones,

                })

                .into_response());

            }

            return Ok(fail("Enter the code from your authenticator app.", Some(username)));

        }

        let now = (db::now_ms() / 1000) as u64;

        if !totp::verify(secret, &f.code, now) {

        }

    }

    app.throttle.lock().unwrap().cleared(&keys[0]);

    accounts::audit(&app.db, Some(&account), "login", &username, "").await.ok();

    Ok(signed_in(&app, &account, &next).await)

}

pub async fn approval_state(State(app): State<Shared>, Form(f): Form<ApprovalPoll>) -> Response {

    let now = db::now_ms();

    let state = async {

        let account = accounts::account_by_name(&app.db, f.username.trim()).await.ok()??;

        if !auth::pending_login_ok(&app.cookie_key, &account.username, &account.session_salt, &f.pending, now) {

            return None;

        }

        let a = db::approvals::get(&app.db, &f.approval).await.ok()??;

        if a.account_id != account.id || a.kind != "signin" {

        }

        Some(if a.state == "pending" && a.expires_ms <= now { "expired".to_string() } else { a.state })

    }

    .await;

    match state {

        Some(s) => axum::Json(serde_json::json!({ "state": s })).into_response(),

        None => (axum::http::StatusCode::NOT_FOUND, axum::Json(serde_json::json!({ "state": "unknown" }))).into_response(),

}

pub async fn signed_in(app: &Shared, account: &accounts::Account, to: &str) -> Response {

    let value = auth::new_session_id();

    if let Err(e) = db::sessions::create(&app.db, account.id, &auth::token_hash(&value), &account.session_salt).await {

    }

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

    let cookie = format!("{}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000{secure}", auth::SESSION_COOKIE);

    ([(header::SET_COOKIE, cookie)], Redirect::to(to)).into_response()

}

pub async fn logout(State(app): State<Shared>, viewer: Viewer, Form(f): Form<CsrfForm>) -> Response {

    if !viewer.csrf_ok(&f.csrf) {

    }

    if let Some(v) = &viewer.0 {

        db::sessions::end_hash(&app.db, &auth::token_hash(&v.session)).await.ok();

        accounts::audit(&app.db, Some(&v.account), "logout", &v.account.username, "").await.ok();

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

    let cookie = format!("{}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0{secure}", auth::SESSION_COOKIE);

    ([(header::SET_COOKIE, cookie)], Redirect::to("/")).into_response()

}

pub async fn registration_mode(app: &Shared) -> String {

    accounts::setting(&app.db, "registration_mode").await.ok().flatten().unwrap_or_else(|| app.config.registration.mode.clone())

}

pub async fn register_form(State(app): State<Shared>, viewer: Viewer, Query(q): Query<InviteQuery>) -> Result<Response, Error> {

    if viewer.signed_in() {

    }

    let shell = Shell::new(&app, "/register", &viewer);

    let first = accounts::account_count(&app.db).await.map_err(|e| Error::from_db(shell.clone(), e))? == 0;

    let mode = registration_mode(&app).await;

    let invite = q.invite.unwrap_or_default().trim().to_string();

    let usable_invite = mode == "invite"

        && super::signin::invite_code_ok(&invite)

        && accounts::invitation_unused(&app.db, &invite).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let providers = if !first && (mode == "open" || usable_invite) { super::signin::buttons(&app).await } else { vec![] };

    let provider_query = if usable_invite { format!("?invite={invite}") } else { String::new() };

    Ok(Page(RegisterPage { shell, error: None, mode, first, invite, providers, provider_query }).into_response())

}

pub async fn register(State(app): State<Shared>, viewer: Viewer, Form(f): Form<RegisterForm>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/register", &viewer);

    let first = accounts::account_count(&app.db).await.map_err(|e| Error::from_db(shell.clone(), e))? == 0;

    let mode = registration_mode(&app).await;

    let fail = |msg: &str| {

        Page(RegisterPage {

            shell: shell.clone(),

            error: Some(msg.into()),

            mode: mode.clone(),

            first,

            invite: f.invite.clone(),

            providers: vec![],

            provider_query: String::new(),

        })

        .into_response()

    };

    let username = f.username.trim().to_string();

    if !crate::repos::names::valid_owner(&username) {

    }

    if let Err(e) = auth::password_ok(&f.password) {

    }

    if first && !crate::setup::matches(&app, &f.setup) {

        return Ok(fail(

            "This hub has no administrator yet. The first account needs the setup code the server logged when it started (also in setup-code in its data directory).",

        ));

    }

    if !first {

        match mode.as_str() {

            "open" => {}

            "invite" => {

                let ok = !f.invite.trim().is_empty()

                    && accounts::invitation_unused(&app.db, f.invite.trim()).await.map_err(|e| Error::from_db(shell.clone(), e))?;

                if !ok {

                    return Ok(fail("Registration needs a valid invitation code."));

                }

    }

    if accounts::account_by_name(&app.db, &username).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_some()

        || accounts::org_by_name(&app.db, &username).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_some()

        || accounts::username_retired(&app.db, &username).await.map_err(|e| Error::from_db(shell.clone(), e))?

        return Ok(fail("That name is taken."));

    }

    let hash = auth::hash_password(&f.password).map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    let account = accounts::create_account(&app.db, &username, f.email.trim(), &hash, &auth::random_hex(16), first)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    if !first && mode == "invite" {

        accounts::use_invitation(&app.db, f.invite.trim(), account.id).await.ok();

    }

    if first {

        crate::setup::spend(&app);

    }

    accounts::audit(&app.db, Some(&account), "register", &username, if first { "first account: administrator" } else { "" }).await.ok();

    if let Err(e) = super::recovery::send_verification(&app, &account).await {

        tracing::info!("verification for {username}: {e}");

    }

    if !first {

        let admins: Vec<(i64, crate::db::notify::Reason)> = accounts::accounts(&app.db)

            .await

            .unwrap_or_default()

            .into_iter()

            .filter(|a| a.is_admin)

            .map(|a| (a.id, crate::db::notify::Reason::Participating))

            .collect();

        let title = format!("New account: {username} signed up on {}", app.config.site.name);

        crate::notify::tell(&app, "account.registered", &title, &format!("/{username}"), &username, None, admins).await;

    }

    Ok(signed_in(&app, &account, "/").await)

}