go-neb/api/handlers/auth.go

package handlers

import (
	"database/sql"
	"encoding/base64"
	"encoding/json"
	"net/http"
	"strings"

	"github.com/matrix-org/go-neb/api"
	"github.com/matrix-org/go-neb/database"
	"github.com/matrix-org/go-neb/metrics"
	"github.com/matrix-org/go-neb/types"
	"github.com/matrix-org/util"
	log "github.com/sirupsen/logrus"
	"maunium.net/go/mautrix/id"
)

// RequestAuthSession represents an HTTP handler capable of processing /admin/requestAuthSession requests.
type RequestAuthSession struct {
	DB *database.ServiceDB
}

// OnIncomingRequest handles POST requests to /admin/requestAuthSession. The HTTP body MUST be
// a JSON object representing type "api.RequestAuthSessionRequest".
//
// This will return HTTP 400 if there are missing fields or the Realm ID is unknown.
// For the format of the response, see the specific AuthRealm that the Realm ID corresponds to.
//
// Request:
//  POST /admin/requestAuthSession
//  {
//      "RealmID": "github_realm_id",
//      "UserID": "@my_user:localhost",
//      "Config": {
//          // AuthRealm specific config info
//      }
//  }
// Response:
//  HTTP/1.1 200 OK
//  {
//      // AuthRealm-specific information
//  }
func (h *RequestAuthSession) OnIncomingRequest(req *http.Request) util.JSONResponse {
	logger := util.GetLogger(req.Context())
	if req.Method != "POST" {
		return util.MessageResponse(405, "Unsupported Method")
	}
	var body api.RequestAuthSessionRequest
	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
		return util.MessageResponse(400, "Error parsing request JSON")
	}
	logger.WithFields(log.Fields{
		"realm_id": body.RealmID,
		"user_id":  body.UserID,
	}).Print("Incoming auth session request")

	if err := body.Check(); err != nil {
		logger.WithError(err).Info("Failed Check")
		return util.MessageResponse(400, err.Error())
	}

	realm, err := h.DB.LoadAuthRealm(body.RealmID)
	if err != nil {
		logger.WithError(err).Info("Failed to LoadAuthRealm")
		return util.MessageResponse(400, "Unknown RealmID")
	}

	response := realm.RequestAuthSession(body.UserID, body.Config)
	if response == nil {
		logger.WithField("body", body).Error("Failed to RequestAuthSession")
		return util.MessageResponse(500, "Failed to request auth session")
	}

	metrics.IncrementAuthSession(realm.Type())

	return util.JSONResponse{
		Code: 200,
		JSON: response,
	}
}

// RemoveAuthSession represents an HTTP handler capable of processing /admin/removeAuthSession requests.
type RemoveAuthSession struct {
	DB *database.ServiceDB
}

// OnIncomingRequest handles POST requests to /admin/removeAuthSession.
//
// The JSON object MUST contain the keys "RealmID" and "UserID" to identify the session to remove.
//
// Request
//  POST /admin/removeAuthSession
//  {
//      "RealmID": "github-realm",
//      "UserID": "@my_user:localhost"
//  }
// Response:
//  HTTP/1.1 200 OK
//  {}
func (h *RemoveAuthSession) OnIncomingRequest(req *http.Request) util.JSONResponse {
	logger := util.GetLogger(req.Context())
	if req.Method != "POST" {
		return util.MessageResponse(405, "Unsupported Method")
	}
	var body struct {
		RealmID string
		UserID  id.UserID
	}
	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
		return util.MessageResponse(400, "Error parsing request JSON")
	}
	logger.WithFields(log.Fields{
		"realm_id": body.RealmID,
		"user_id":  body.UserID,
	}).Print("Incoming remove auth session request")

	if body.UserID == "" || body.RealmID == "" {
		return util.MessageResponse(400, `Must supply a "UserID", a "RealmID"`)
	}

	_, err := h.DB.LoadAuthRealm(body.RealmID)
	if err != nil {
		return util.MessageResponse(400, "Unknown RealmID")
	}

	if err := h.DB.RemoveAuthSession(body.RealmID, body.UserID); err != nil {
		logger.WithError(err).Error("Failed to RemoveAuthSession")
		return util.MessageResponse(500, "Failed to remove auth session")
	}

	return util.JSONResponse{
		Code: 200,
		JSON: struct{}{},
	}
}

// RealmRedirect represents an HTTP handler which can process incoming redirects for auth realms.
type RealmRedirect struct {
	DB *database.ServiceDB
}

// Handle requests for an auth realm.
//
// The last path segment of the URL MUST be the base64 form of the Realm ID. What response
// this returns depends on the specific AuthRealm implementation.
func (rh *RealmRedirect) Handle(w http.ResponseWriter, req *http.Request) {
	segments := strings.Split(req.URL.Path, "/")
	// last path segment is the base64d realm ID which we will pass the incoming request to
	base64realmID := segments[len(segments)-1]
	bytesRealmID, err := base64.RawURLEncoding.DecodeString(base64realmID)
	realmID := string(bytesRealmID)
	if err != nil {
		log.WithError(err).WithField("base64_realm_id", base64realmID).Print(
			"Not a b64 encoded string",
		)
		w.WriteHeader(400)
		return
	}

	realm, err := rh.DB.LoadAuthRealm(realmID)
	if err != nil {
		log.WithError(err).WithField("realm_id", realmID).Print("Failed to load realm")
		w.WriteHeader(404)
		return
	}
	log.WithFields(log.Fields{
		"realm_id": realmID,
	}).Print("Incoming realm redirect request")
	realm.OnReceiveRedirect(w, req)
}

// ConfigureAuthRealm represents an HTTP handler capable of processing /admin/configureAuthRealm requests.
type ConfigureAuthRealm struct {
	DB *database.ServiceDB
}

// OnIncomingRequest handles POST requests to /admin/configureAuthRealm. The JSON object
// provided is of type "api.ConfigureAuthRealmRequest".
//
// Request:
//  POST /admin/configureAuthRealm
//  {
//      "ID": "my-realm-id",
//      "Type": "github",
//      "Config": {
//          // Realm-specific configuration information
//      }
//  }
// Response:
//  HTTP/1.1 200 OK
//  {
//      "ID": "my-realm-id",
//      "Type": "github",
//      "OldConfig": {
//          // Old auth realm config information
//      },
//      "NewConfig": {
//          // New auth realm config information
//      },
//  }
func (h *ConfigureAuthRealm) OnIncomingRequest(req *http.Request) util.JSONResponse {
	logger := util.GetLogger(req.Context())
	if req.Method != "POST" {
		return util.MessageResponse(405, "Unsupported Method")
	}
	var body api.ConfigureAuthRealmRequest
	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
		return util.MessageResponse(400, "Error parsing request JSON")
	}

	if err := body.Check(); err != nil {
		return util.MessageResponse(400, err.Error())
	}

	realm, err := types.CreateAuthRealm(body.ID, body.Type, body.Config)
	if err != nil {
		return util.MessageResponse(400, "Error parsing config JSON")
	}

	if err = realm.Register(); err != nil {
		return util.MessageResponse(400, "Error registering auth realm")
	}

	oldRealm, err := h.DB.StoreAuthRealm(realm)
	if err != nil {
		logger.WithError(err).Error("Failed to StoreAuthRealm")
		return util.MessageResponse(500, "Error storing realm")
	}

	return util.JSONResponse{
		Code: 200,
		JSON: struct {
			ID        string
			Type      string
			OldConfig types.AuthRealm
			NewConfig types.AuthRealm
		}{body.ID, body.Type, oldRealm, realm},
	}
}

// GetSession represents an HTTP handler capable of processing /admin/getSession requests.
type GetSession struct {
	DB *database.ServiceDB
}

// OnIncomingRequest handles POST requests to /admin/getSession.
//
// The JSON object provided MUST have a "RealmID" and "UserID" in order to fetch the
// correct AuthSession. If there is no session for this tuple of realm and user ID,
// a 200 OK is still returned with "Authenticated" set to false.
//
// Request:
//  POST /admin/getSession
//  {
//      "RealmID": "my-realm",
//      "UserID": "@my_user:localhost"
//  }
// Response:
//  HTTP/1.1 200 OK
//  {
//      "ID": "session_id",
//      "Authenticated": true,
//      "Info": {
//          // Session-specific config info
//      }
//  }
// Response if session not found:
//  HTTP/1.1 200 OK
//  {
//      "Authenticated": false
//  }
func (h *GetSession) OnIncomingRequest(req *http.Request) util.JSONResponse {
	logger := util.GetLogger(req.Context())
	if req.Method != "POST" {
		return util.MessageResponse(405, "Unsupported Method")
	}
	var body struct {
		RealmID string
		UserID  id.UserID
	}
	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
		return util.MessageResponse(400, "Error parsing request JSON")
	}

	if body.RealmID == "" || body.UserID == "" {
		return util.MessageResponse(400, `Must supply a "RealmID" and "UserID"`)
	}

	session, err := h.DB.LoadAuthSessionByUser(body.RealmID, body.UserID)
	if err != nil && err != sql.ErrNoRows {
		logger.WithError(err).WithField("body", body).Error("Failed to LoadAuthSessionByUser")
		return util.MessageResponse(500, `Failed to load session`)
	}
	if err == sql.ErrNoRows {
		return util.JSONResponse{
			Code: 200,
			JSON: struct {
				Authenticated bool
			}{false},
		}
	}

	return util.JSONResponse{
		Code: 200,
		JSON: struct {
			ID            string
			Authenticated bool
			Info          interface{}
		}{session.ID(), session.Authenticated(), session.Info()},
	}
}