rustfmt; implement role-based auth checks

1 files changed, 151 insertions, 41 deletions

diff --git a/rust/src/auth.rs b/rust/src/auth.rs
index 450a19d6..ee3c6fb0 100644
--- a/rust/src/auth.rs
+++ b/rust/src/auth.rs
@@ -1,33 +1,76 @@
 //! Editor bearer token authentication
 
-use swagger::auth::AuthData;
-use macaroon::{Format, Macaroon, Verifier};
 use data_encoding::BASE64;
+use macaroon::{Format, Macaroon, Verifier};
+use swagger::auth::AuthData;
 
-use std::collections::HashMap;
-use database_models::*;
-use database_schema::*;
 use api_helpers::*;
 use chrono::prelude::*;
+use database_models::*;
+use database_schema::*;
 use diesel;
 use diesel::prelude::*;
 use errors::*;
+use std::collections::HashMap;
 use std::str::FromStr;
 
 // 32 bytes max (!)
 static DUMMY_KEY: &[u8] = b"dummy-key-a-one-two-three-a-la";
 
+#[derive(Clone, Copy, Debug)]
+pub enum FatcatRole {
+    Public,
+    Editor,
+    Bot,
+    Human,
+    Admin,
+}
+
 #[derive(Clone)]
 pub struct AuthContext {
     pub editor_id: FatCatId,
     editor_row: EditorRow,
-    roles: Vec<String>, // TODO: BTreeSet
 }
 
 impl AuthContext {
+    pub fn has_role(&self, role: FatcatRole) -> bool {
+        if self.editor_row.is_admin {
+            return true;
+        }
+        match role {
+            FatcatRole::Public => true,
+            FatcatRole::Editor => true,
+            FatcatRole::Bot => self.editor_row.is_bot,
+            FatcatRole::Human => !self.editor_row.is_bot,
+            FatcatRole::Admin => self.editor_row.is_admin,
+        }
+    }
 
-    pub fn has_role(&self, role: &str) -> bool {
-        self.roles.contains(&role.to_string()) || self.roles.contains(&"admin".to_string())
+    pub fn require_role(&self, role: FatcatRole) -> Result<()> {
+        match self.has_role(role) {
+            true => Ok(()),
+            // TODO: better message
+            false => Err(ErrorKind::InsufficientPrivileges(
+                "doesn't have required role".to_string(),
+            )
+            .into()),
+        }
+    }
+
+    pub fn require_editgroup(&self, conn: &DbConn, editgroup_id: FatCatId) -> Result<()> {
+        if self.has_role(FatcatRole::Admin) {
+            return Ok(())
+        }
+        let editgroup: EditgroupRow = editgroup::table
+            .find(editgroup_id.to_uuid())
+            .get_result(conn)?;
+        match editgroup.editor_id == self.editor_id.to_uuid() {
+            true => Ok(()),
+            false => Err(ErrorKind::InsufficientPrivileges(
+                "editor does not own this editgroup".to_string(),
+            )
+            .into()),
+        }
     }
 }
 
@@ -40,7 +83,11 @@ pub struct AuthConfectionary {
 }
 
 impl AuthConfectionary {
-    pub fn new(location: String, identifier: String, key_base64: String) -> Result<AuthConfectionary> {
+    pub fn new(
+        location: String,
+        identifier: String,
+        key_base64: String,
+    ) -> Result<AuthConfectionary> {
         let key = BASE64.decode(key_base64.as_bytes())?;
         let mut root_keys = HashMap::new();
         root_keys.insert(identifier.clone(), key.clone());
@@ -57,18 +104,26 @@ impl AuthConfectionary {
             "test.fatcat.wiki".to_string(),
             "dummy".to_string(),
             BASE64.encode(DUMMY_KEY),
-        ).unwrap()
+        )
+        .unwrap()
     }
 
-    pub fn create_token(&self, editor_id: FatCatId, expires: Option<DateTime<Utc>>) -> Result<String> {
-        let mut mac = Macaroon::create(&self.location, &self.key, &self.identifier).expect("Macaroon creation");
+    pub fn create_token(
+        &self,
+        editor_id: FatCatId,
+        expires: Option<DateTime<Utc>>,
+    ) -> Result<String> {
+        let mut mac = Macaroon::create(&self.location, &self.key, &self.identifier)
+            .expect("Macaroon creation");
         mac.add_first_party_caveat(&format!("editor_id = {}", editor_id.to_string()));
         // TODO: put created one second in the past to prevent timing synchronization glitches?
         let now = Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true);
         mac.add_first_party_caveat(&format!("created = {}", now));
         if let Some(expires) = expires {
-            mac.add_first_party_caveat(&format!("expires = {:?}",
-                &expires.to_rfc3339_opts(SecondsFormat::Secs, true)));
+            mac.add_first_party_caveat(&format!(
+                "expires = {:?}",
+                &expires.to_rfc3339_opts(SecondsFormat::Secs, true)
+            ));
         };
         let raw = mac.serialize(Format::V2).expect("macaroon serialization");
         Ok(BASE64.encode(&raw))
@@ -79,18 +134,30 @@ impl AuthConfectionary {
         let raw = BASE64.decode(s.as_bytes())?;
         let mac = match Macaroon::deserialize(&raw) {
             Ok(m) => m,
-            Err(e) => bail!("macaroon deserialize error: {:?}", e),
+            Err(_e) => {
+                // TODO: should be "chaining" here
+                //bail!("macaroon deserialize error: {:?}", e),
+                return Err(
+                    ErrorKind::InvalidCredentials("macaroon deserialize error".to_string()).into(),
+                );
+            }
         };
         let mac = match mac.validate() {
             Ok(m) => m,
-            Err(e) => bail!("macaroon validate error: {:?}", e),
+            Err(_e) => {
+                // TODO: should be "chaining" here
+                //bail!("macaroon validate error: {:?}", e),
+                return Err(
+                    ErrorKind::InvalidCredentials("macaroon validate error".to_string()).into(),
+                );
+            }
         };
         let mut verifier = Verifier::new();
         let mut editor_id: Option<FatCatId> = None;
         for caveat in mac.first_party_caveats() {
             if caveat.predicate().starts_with("editor_id = ") {
                 editor_id = Some(FatCatId::from_str(caveat.predicate().get(12..).unwrap())?);
-                break
+                break;
             }
         }
         let editor_id = editor_id.expect("expected an editor_id caveat");
@@ -98,20 +165,27 @@ impl AuthConfectionary {
         let mut created: Option<DateTime<Utc>> = None;
         for caveat in mac.first_party_caveats() {
             if caveat.predicate().starts_with("created = ") {
-                created = Some(DateTime::parse_from_rfc3339(caveat.predicate().get(10..).unwrap())
-                    .unwrap()
-                    .with_timezone(&Utc));
-                break
+                created = Some(
+                    DateTime::parse_from_rfc3339(caveat.predicate().get(10..).unwrap())
+                        .unwrap()
+                        .with_timezone(&Utc),
+                );
+                break;
             }
         }
         let created = created.expect("expected a 'created' caveat");
-        verifier.satisfy_exact(&format!("created = {}", created.to_rfc3339_opts(SecondsFormat::Secs, true)));
-        let editor: EditorRow = editor::table
-            .find(&editor_id.to_uuid())
-            .get_result(conn)?;
+        verifier.satisfy_exact(&format!(
+            "created = {}",
+            created.to_rfc3339_opts(SecondsFormat::Secs, true)
+        ));
+        let editor: EditorRow = editor::table.find(&editor_id.to_uuid()).get_result(conn)?;
         let auth_epoch = DateTime::<Utc>::from_utc(editor.auth_epoch, Utc);
         if created < auth_epoch {
-            bail!("token created before current auth_epoch (was probably revoked by editor)")
+            return Err(ErrorKind::InvalidCredentials(
+                "token created before current auth_epoch (was probably revoked by editor)"
+                    .to_string(),
+            )
+            .into());
         }
         verifier.satisfy_general(|p: &str| -> bool {
             // not expired (based on expires)
@@ -126,42 +200,78 @@ impl AuthConfectionary {
         });
         let verify_key = match self.root_keys.get(mac.identifier()) {
             Some(key) => key,
-            None => bail!("key not found for identifier: {}", mac.identifier()),
+            None => {
+                // TODO: better message
+                //bail!("key not found for identifier: {}", mac.identifier()),
+                return Err(ErrorKind::InvalidCredentials(
+                    "key not found for identifier".to_string(),
+                )
+                .into());
+            }
         };
         match mac.verify(verify_key, &mut verifier) {
             Ok(true) => (),
-            Ok(false) => bail!("token overall verification failed"),
-            Err(e) => bail!("token parsing failed: {:?}", e),
+            Ok(false) => {
+                return Err(ErrorKind::InvalidCredentials(
+                    "token overall verification failed".to_string(),
+                )
+                .into());
+            }
+            Err(_e) => {
+                // TODO: chain
+                //bail!("token parsing failed: {:?}", e),
+                return Err(
+                    ErrorKind::InvalidCredentials("token parsing failed".to_string()).into(),
+                );
+            }
         }
         Ok(editor)
     }
 
-    pub fn parse_swagger(&self, conn: &DbConn, auth_data: &Option<AuthData>) -> Result<Option<AuthContext>> {
-
+    pub fn parse_swagger(
+        &self,
+        conn: &DbConn,
+        auth_data: &Option<AuthData>,
+    ) -> Result<Option<AuthContext>> {
         let token: Option<String> = match auth_data {
             Some(AuthData::ApiKey(header)) => {
-                let header: Vec<String> = header.split_whitespace().map(|s| s.to_string()).collect();
+                let header: Vec<String> =
+                    header.split_whitespace().map(|s| s.to_string()).collect();
                 if !(header.len() == 2 && header[0] == "Bearer") {
-                    bail!("invalid Bearer Auth HTTP header");
+                    return Err(ErrorKind::InvalidCredentials(
+                        "invalid Bearer Auth HTTP header".to_string(),
+                    )
+                    .into());
                 }
                 Some(header[1].clone())
-            },
+            }
             None => None,
-            _ => bail!("Authentication HTTP Header should either be empty or a Beaerer API key"),
+            _ => {
+                return Err(ErrorKind::InvalidCredentials(
+                    "Authentication HTTP Header should either be empty or a Beaerer API key"
+                        .to_string(),
+                )
+                .into());
+            }
         };
         let token = match token {
             Some(t) => t,
             None => return Ok(None),
         };
         let editor_row = self.parse_macaroon_token(conn, &token)?;
-        let roles = if editor_row.is_admin { vec!["admin".to_string()] } else { vec![] };
         Ok(Some(AuthContext {
             editor_id: FatCatId::from_uuid(&editor_row.id),
             editor_row: editor_row,
-            roles: roles,
         }))
     }
 
+    pub fn require_auth(&self, conn: &DbConn, auth_data: &Option<AuthData>) -> Result<AuthContext> {
+        match self.parse_swagger(conn, auth_data)? {
+            Some(auth) => Ok(auth),
+            None => Err(ErrorKind::InvalidCredentials("no token supplied".to_string()).into()),
+        }
+    }
+
     // TODO: refactor out of this file?
     /// Only used from CLI tool
     pub fn inspect_token(&self, conn: &DbConn, token: &str) -> Result<()> {
@@ -206,13 +316,13 @@ pub fn revoke_tokens_everyone(conn: &DbConn) -> Result<()> {
 
 // TODO: refactor out of this file?
 /// Only used from CLI tool
-pub fn print_editors(conn: &DbConn) -> Result<()>{
+pub fn print_editors(conn: &DbConn) -> Result<()> {
     // iterate over all editors. format id, print flags, auth_epoch
-    let all_editors: Vec<EditorRow> = editor::table
-        .load(conn)?;
+    let all_editors: Vec<EditorRow> = editor::table.load(conn)?;
     println!("editor_id\t\t\tis_admin/is_bot\tauth_epoch\t\t\tusername\twrangler_id");
     for e in all_editors {
-        println!("{}\t{}\t{}\t{}\t{}\t{:?}",
+        println!(
+            "{}\t{}\t{}\t{}\t{}\t{:?}",
             FatCatId::from_uuid(&e.id).to_string(),
             e.is_admin,
             e.is_bot,