approvals.rs 79.7%

98 of 123 lines run, 14 of 34 functions · run #538 on main · run missed

//! A phone as a second factor over the API (oxygenhub#356): register this
//! phone's Keystore key, list and remove phones, and answer the approvals
//! a browser asks for. Agents' tokens can do none of it.

use super::{caller, ApiError, Caller};
use crate::auth::{phone, totp};
use crate::db::{self, accounts, approvals};
use crate::Shared;
use axum::extract::{Path, State};
use axum::http::{HeaderMap, StatusCode};
use axum::Json;
use hub_api::{ApprovalAnswer, Authenticator, NewAuthenticator, PendingApproval};

/// The caller as a person's phone: its account and the token it signed in with.
fn phone_of(c: &Caller) -> Result<(&accounts::Account, i64), ApiError> {
    let account = c.require("user:read")?;
    if c.agent {
        return Err(ApiError(StatusCode::FORBIDDEN, "an agent cannot be a second factor".into()));
    }
    let Some(id) = c.token_id else {
        return Err(ApiError(StatusCode::UNAUTHORIZED, "a phone uses the token it signed in with".into()));
    };
    Ok((account, id))
}

/// `POST /api/v1/user/authenticators`: this phone as a second factor. It
/// needs the account's current authenticator-app code, so a token alone
/// cannot add one, and the app code stays the way in when the phone is lost.
pub async fn add(
    State(app): State<Shared>,
    headers: HeaderMap,
    Json(r): Json<NewAuthenticator>,
) -> Result<(StatusCode, Json<Authenticator>), ApiError> {
    let c = caller(&app, &headers).await?;
    let (account, id) = phone_of(&c)?;
    let Some(secret) = account.totp_secret.as_deref() else {
        return Err(ApiError(
            StatusCode::CONFLICT,
            "set up an authenticator app first (Settings › Security on the hub): it stays the way in if this phone is lost".into(),
        ));
    };
    if !totp::verify(secret, r.code.trim(), (db::now_ms() / 1000) as u64) {
        accounts::audit(&app.db, Some(account), "2fa.phone_add_failed", &c.token, "wrong code").await.ok();
        return Err(ApiError(StatusCode::FORBIDDEN, "that code is not right".into()));
    }
    let Some(point) = phone::public_point(&r.public_key) else {
        return Err(ApiError(StatusCode::BAD_REQUEST, "public_key is a P-256 key: hex of its SubjectPublicKeyInfo".into()));
    };
    approvals::add_authenticator(&app.db, id, account.id, &c.token, &point).await?;
    accounts::audit(&app.db, Some(account), "2fa.phone_added", &c.token, "").await.ok();
    let a = approvals::authenticator(&app.db, id).await?.expect("just added");
    Ok((StatusCode::CREATED, Json(Authenticator { id, name: a.name, created_ms: a.created_ms, last_used_ms: a.last_used_ms, this: true })))
}

/// `GET /api/v1/user/authenticators`: the account's phones.
pub async fn list(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Authenticator>>, ApiError> {
    let c = caller(&app, &headers).await?;
    let account = c.require("user:read")?;
    let this = c.token_id;
    Ok(Json(
        approvals::authenticators(&app.db, account.id)
            .await?
            .into_iter()
            .map(|a| Authenticator {
                this: Some(a.token_id) == this,
                id: a.token_id,
                name: a.name,
                created_ms: a.created_ms,
                last_used_ms: a.last_used_ms,
            })
            .collect(),
    ))
}

/// `DELETE /api/v1/user/authenticators`: this phone stops being a second factor.
pub async fn remove(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {
    let c = caller(&app, &headers).await?;
    let (account, id) = phone_of(&c)?;
    if approvals::remove_authenticator(&app.db, account.id, id).await? {
        accounts::audit(&app.db, Some(account), "2fa.phone_removed", &c.token, "").await.ok();
    }
    Ok(StatusCode::NO_CONTENT)
}

/// `GET /api/v1/user/approvals`: what waits for this phone's answer.
pub async fn pending(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<PendingApproval>>, ApiError> {
    let c = caller(&app, &headers).await?;
    let (account, id) = phone_of(&c)?;
    if approvals::authenticator(&app.db, id).await?.is_none() {
        return Ok(Json(Vec::new()));
    }
    Ok(Json(
        approvals::pending(&app.db, account.id, db::now_ms())
            .await?
            .into_iter()
            .map(|a| PendingApproval {
                choices: a.choices.split(',').filter_map(|n| n.parse().ok()).collect(),
                id: a.id,
                kind: a.kind,
                what: a.what,
                created_ms: a.created_ms,
                expires_ms: a.expires_ms,
            })
            .collect(),
    ))
}

/// `POST /api/v1/user/approvals/{id}`: this phone's answer. Approving takes
/// the number the browser shows and the phone key's signature; a wrong
/// number denies it, as a guess should.
pub async fn answer(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path(approval): Path<String>,
    Json(r): Json<ApprovalAnswer>,
) -> Result<Json<serde_json::Value>, ApiError> {
    let c = caller(&app, &headers).await?;
    let (account, id) = phone_of(&c)?;
    let Some(key) = approvals::authenticator(&app.db, id).await?.filter(|a| a.account_id == account.id) else {
        return Err(ApiError(StatusCode::FORBIDDEN, "this phone is not a second factor of the account".into()));
    };
    let now = db::now_ms();
    let Some(a) = approvals::get(&app.db, &approval).await?.filter(|a| a.account_id == account.id) else {
        return Err(ApiError(StatusCode::NOT_FOUND, "no such approval".into()));
    };
    if a.state != "pending" || a.expires_ms <= now {
        return Err(ApiError(StatusCode::CONFLICT, "that approval was answered already, or ran out of time".into()));
    }
    let state = if !r.approve {
        "denied"
    } else {
        let Ok(sig) = hex::decode(r.signature.trim()) else {
            return Err(ApiError(StatusCode::BAD_REQUEST, "signature is hex".into()));
        };
        if !phone::verify(&key.public_key, &phone::message(&a.id, r.number, true), &sig) {
            accounts::audit(&app.db, Some(account), "2fa.bad_signature", &c.token, &a.kind).await.ok();
            return Err(ApiError(StatusCode::FORBIDDEN, "the signature is not this phone's".into()));
        }
        if r.number == a.number {
            "approved"
        } else {
            "denied"
        }
    };
    if !approvals::decide(&app.db, &a.id, state, id, now).await? {
        return Err(ApiError(StatusCode::CONFLICT, "that approval was answered already, or ran out of time".into()));
    }
    if state == "approved" {
        if let Some(session) = a.session_id.filter(|_| a.kind == "stepup") {
            db::sessions::mark_second_factor(&app.db, session, now).await?;
        }
    }
    let detail = if r.approve && state == "denied" { format!("{}: wrong number", a.kind) } else { a.kind.clone() };
    accounts::audit(&app.db, Some(account), &format!("2fa.{state}"), &c.token, &detail).await.ok();
    Ok(Json(serde_json::json!({ "state": state })))
}

1		//! A phone as a second factor over the API (oxygenhub#356): register this
2		//! phone's Keystore key, list and remove phones, and answer the approvals
3		//! a browser asks for. Agents' tokens can do none of it.
4
5		use super::{caller, ApiError, Caller};
6		use crate::auth::{phone, totp};
7		use crate::db::{self, accounts, approvals};
8		use crate::Shared;
9		use axum::extract::{Path, State};
10		use axum::http::{HeaderMap, StatusCode};
11		use axum::Json;
12		use hub_api::{ApprovalAnswer, Authenticator, NewAuthenticator, PendingApproval};
13
14		/// The caller as a person's phone: its account and the token it signed in with.
15	10×	fn phone_of(c: &Caller) -> Result<(&accounts::Account, i64), ApiError> {
16	10×	let account = c.require("user:read")?;
17	10×	if c.agent {
18	0×	return Err(ApiError(StatusCode::FORBIDDEN, "an agent cannot be a second factor".into()));
19	10×	}
20	10×	let Some(id) = c.token_id else {
21	0×	return Err(ApiError(StatusCode::UNAUTHORIZED, "a phone uses the token it signed in with".into()));
22		};
23	10×	Ok((account, id))
24	10×	}
25
26		/// `POST /api/v1/user/authenticators`: this phone as a second factor. It
27		/// needs the account's current authenticator-app code, so a token alone
28		/// cannot add one, and the app code stays the way in when the phone is lost.
29	3×	pub async fn add(
30	3×	State(app): State<Shared>,
31	3×	headers: HeaderMap,
32	3×	Json(r): Json<NewAuthenticator>,
33	3×	) -> Result<(StatusCode, Json<Authenticator>), ApiError> {
34	3×	let c = caller(&app, &headers).await?;
35	3×	let (account, id) = phone_of(&c)?;
36	3×	let Some(secret) = account.totp_secret.as_deref() else {
37	1×	return Err(ApiError(
38	1×	StatusCode::CONFLICT,
39	1×	"set up an authenticator app first (Settings › Security on the hub): it stays the way in if this phone is lost".into(),
40	1×	));
41		};
42	2×	if !totp::verify(secret, r.code.trim(), (db::now_ms() / 1000) as u64) {
43	1×	accounts::audit(&app.db, Some(account), "2fa.phone_add_failed", &c.token, "wrong code").await.ok();
44	1×	return Err(ApiError(StatusCode::FORBIDDEN, "that code is not right".into()));
45	1×	}
46	1×	let Some(point) = phone::public_point(&r.public_key) else {
47	0×	return Err(ApiError(StatusCode::BAD_REQUEST, "public_key is a P-256 key: hex of its SubjectPublicKeyInfo".into()));
48		};
49	1×	approvals::add_authenticator(&app.db, id, account.id, &c.token, &point).await?;
50	1×	accounts::audit(&app.db, Some(account), "2fa.phone_added", &c.token, "").await.ok();
51	1×	let a = approvals::authenticator(&app.db, id).await?.expect("just added");
52	1×	Ok((StatusCode::CREATED, Json(Authenticator { id, name: a.name, created_ms: a.created_ms, last_used_ms: a.last_used_ms, this: true })))
53	3×	}
54
55		/// `GET /api/v1/user/authenticators`: the account's phones.
56	1×	pub async fn list(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Authenticator>>, ApiError> {
57	1×	let c = caller(&app, &headers).await?;
58	1×	let account = c.require("user:read")?;
59	1×	let this = c.token_id;
60		Ok(Json(
61	1×	approvals::authenticators(&app.db, account.id)
62	1×	.await?
63	1×	.into_iter()
64	1×	.map(\|a\| Authenticator {
65	0×	this: Some(a.token_id) == this,
66	0×	id: a.token_id,
67	0×	name: a.name,
68	0×	created_ms: a.created_ms,
69	0×	last_used_ms: a.last_used_ms,
70	0×	})
71	1×	.collect(),
72		))
73	1×	}
74
75		/// `DELETE /api/v1/user/authenticators`: this phone stops being a second factor.
76	0×	pub async fn remove(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {
77	0×	let c = caller(&app, &headers).await?;
78	0×	let (account, id) = phone_of(&c)?;
79	0×	if approvals::remove_authenticator(&app.db, account.id, id).await? {
80	0×	accounts::audit(&app.db, Some(account), "2fa.phone_removed", &c.token, "").await.ok();
81	0×	}
82	0×	Ok(StatusCode::NO_CONTENT)
83	0×	}
84
85		/// `GET /api/v1/user/approvals`: what waits for this phone's answer.
86	3×	pub async fn pending(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<PendingApproval>>, ApiError> {
87	3×	let c = caller(&app, &headers).await?;
88	3×	let (account, id) = phone_of(&c)?;
89	3×	if approvals::authenticator(&app.db, id).await?.is_none() {
90	0×	return Ok(Json(Vec::new()));
91	3×	}
92		Ok(Json(
93	3×	approvals::pending(&app.db, account.id, db::now_ms())
94	3×	.await?
95	3×	.into_iter()
96	3×	.map(\|a\| PendingApproval {
97	9×	choices: a.choices.split(',').filter_map(\|n\| n.parse().ok()).collect(),
98	3×	id: a.id,
99	3×	kind: a.kind,
100	3×	what: a.what,
101	3×	created_ms: a.created_ms,
102	3×	expires_ms: a.expires_ms,
103	3×	})
104	3×	.collect(),
105		))
106	3×	}
107
108		/// `POST /api/v1/user/approvals/{id}`: this phone's answer. Approving takes
109		/// the number the browser shows and the phone key's signature; a wrong
110		/// number denies it, as a guess should.
111	4×	pub async fn answer(
112	4×	State(app): State<Shared>,
113	4×	headers: HeaderMap,
114	4×	Path(approval): Path<String>,
115	4×	Json(r): Json<ApprovalAnswer>,
116	4×	) -> Result<Json<serde_json::Value>, ApiError> {
117	4×	let c = caller(&app, &headers).await?;
118	4×	let (account, id) = phone_of(&c)?;
119	4×	let Some(key) = approvals::authenticator(&app.db, id).await?.filter(\|a\| a.account_id == account.id) else {
120	0×	return Err(ApiError(StatusCode::FORBIDDEN, "this phone is not a second factor of the account".into()));
121		};
122	4×	let now = db::now_ms();
123	4×	let Some(a) = approvals::get(&app.db, &approval).await?.filter(\|a\| a.account_id == account.id) else {
124	0×	return Err(ApiError(StatusCode::NOT_FOUND, "no such approval".into()));
125		};
126	4×	if a.state != "pending" \|\| a.expires_ms <= now {
127	0×	return Err(ApiError(StatusCode::CONFLICT, "that approval was answered already, or ran out of time".into()));
128	4×	}
129	4×	let state = if !r.approve {
130	0×	"denied"
131		} else {
132	4×	let Ok(sig) = hex::decode(r.signature.trim()) else {
133	0×	return Err(ApiError(StatusCode::BAD_REQUEST, "signature is hex".into()));
134		};
135	4×	if !phone::verify(&key.public_key, &phone::message(&a.id, r.number, true), &sig) {
136	1×	accounts::audit(&app.db, Some(account), "2fa.bad_signature", &c.token, &a.kind).await.ok();
137	1×	return Err(ApiError(StatusCode::FORBIDDEN, "the signature is not this phone's".into()));
138	3×	}
139	3×	if r.number == a.number {
140	2×	"approved"
141		} else {
142	1×	"denied"
143		}
144		};
145	3×	if !approvals::decide(&app.db, &a.id, state, id, now).await? {
146	0×	return Err(ApiError(StatusCode::CONFLICT, "that approval was answered already, or ran out of time".into()));
147	3×	}
148	3×	if state == "approved" {
149	2×	if let Some(session) = a.session_id.filter(\|_\| a.kind == "stepup") {
150	1×	db::sessions::mark_second_factor(&app.db, session, now).await?;
151	1×	}
152	1×	}
153	3×	let detail = if r.approve && state == "denied" { format!("{}: wrong number", a.kind) } else { a.kind.clone() };
154	3×	accounts::audit(&app.db, Some(account), &format!("2fa.{state}"), &c.token, &detail).await.ok();
155	3×	Ok(Json(serde_json::json!({ "state": state })))
156	4×	}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/api/approvals.rs 79.7%

Keyboard