1 files changed, 470 insertions, 0 deletions
diff --git a/rust/src/auth.rs b/rust/src/auth.rs
new file mode 100644
index 00000000..d4e03ecf
--- /dev/null
+++ b/rust/src/auth.rs
@@ -0,0 +1,470 @@
+//! Editor bearer token authentication
+
+use data_encoding::BASE64;
+use macaroon::{Format, Macaroon, Verifier};
+use std::fmt;
+use swagger::auth::{AuthData, Authorization, Scopes};
+
+use api_helpers::*;
+use chrono::prelude::*;
+use database_models::*;
+use database_schema::*;
+use diesel;
+use diesel::prelude::*;
+use errors::*;
+use std::collections::HashMap;
+use std::str::FromStr;
+
+// 32 bytes max (!)
+static DUMMY_KEY: &[u8] = b"dummy-key-a-one-two-three-a-la";
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum FatcatRole {
+    Public,
+    Editor,
+    Bot,
+    Human,
+    Admin,
+    Superuser,
+}
+
+#[derive(Clone)]
+pub struct AuthContext {
+    pub editor_id: FatCatId,
+    editor_row: EditorRow,
+}
+
+impl AuthContext {
+    pub fn has_role(&self, role: FatcatRole) -> bool {
+        if !self.editor_row.is_active {
+            // if account is disabled, only allow public role
+            return role == FatcatRole::Public;
+        }
+        if self.editor_row.is_superuser {
+            return true;
+        }
+        match role {
+            FatcatRole::Public => true,
+            FatcatRole::Editor => true,
+            FatcatRole::Bot => self.editor_row.is_bot,
+            FatcatRole::Human => !self.editor_row.is_bot,
+            FatcatRole::Admin => self.editor_row.is_admin,
+            FatcatRole::Superuser => self.editor_row.is_superuser,
+        }
+    }
+
+    pub fn require_role(&self, role: FatcatRole) -> Result<()> {
+        match self.has_role(role) {
+            true => Ok(()),
+            false => Err(ErrorKind::InsufficientPrivileges(format!(
+                "doesn't have required role: {:?}",
+                role
+            ))
+            .into()),
+        }
+    }
+
+    pub fn require_editgroup(&self, conn: &DbConn, editgroup_id: FatCatId) -> Result<()> {
+        if self.has_role(FatcatRole::Admin) {
+            return Ok(());
+        }
+        let editgroup: EditgroupRow = editgroup::table
+            .find(editgroup_id.to_uuid())
+            .get_result(conn)?;
+        match editgroup.editor_id == self.editor_id.to_uuid() {
+            true => Ok(()),
+            false => Err(ErrorKind::InsufficientPrivileges(
+                "editor does not own this editgroup".to_string(),
+            )
+            .into()),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct AuthError {
+    msg: String,
+}
+
+impl fmt::Display for AuthError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "AuthError: {}", &self.msg)
+    }
+}
+
+impl iron::Error for AuthError {
+    fn description(&self) -> &str {
+        &self.msg
+    }
+    fn cause(&self) -> Option<&iron::Error> {
+        None
+    }
+}
+
+fn new_auth_ironerror(m: &str) -> iron::error::IronError {
+    iron::error::IronError::new(
+        AuthError { msg: m.to_string() },
+        (iron::status::BadRequest, m.to_string()),
+    )
+}
+
+#[derive(Debug)]
+pub struct OpenAuthMiddleware;
+
+impl OpenAuthMiddleware {
+    /// Create a middleware that authorizes with the configured subject.
+    pub fn new() -> OpenAuthMiddleware {
+        OpenAuthMiddleware
+    }
+}
+
+impl iron::middleware::BeforeMiddleware for OpenAuthMiddleware {
+    fn before(&self, req: &mut iron::Request) -> iron::IronResult<()> {
+        req.extensions.insert::<Authorization>(Authorization {
+            subject: "undefined".to_string(),
+            scopes: Scopes::All,
+            issuer: None,
+        });
+        Ok(())
+    }
+}
+
+#[derive(Debug)]
+pub struct MacaroonAuthMiddleware;
+
+impl MacaroonAuthMiddleware {
+    pub fn new() -> MacaroonAuthMiddleware {
+        MacaroonAuthMiddleware
+    }
+}
+impl iron::middleware::BeforeMiddleware for MacaroonAuthMiddleware {
+    fn before(&self, req: &mut iron::Request) -> iron::IronResult<()> {
+        // Structure here is sorta funky because we might some day actually want to parse token
+        // here in some way
+        let token: Option<String> = match req.extensions.get::<AuthData>() {
+            Some(AuthData::ApiKey(header)) => {
+                let header: Vec<String> =
+                    header.split_whitespace().map(|s| s.to_string()).collect();
+                if !(header.len() == 2 && header[0] == "Bearer") {
+                    return Err(new_auth_ironerror("invalid bearer auth HTTP Header"));
+                }
+                Some(header[1].to_string())
+            }
+            None => None,
+            _ => {
+                return Err(new_auth_ironerror(
+                    "auth HTTP Header should be empty or API token",
+                ));
+            }
+        };
+        if let Some(_token) = token {
+            req.extensions.insert::<Authorization>(Authorization {
+                // This is just a dummy; all actual authentication happens later
+                subject: "undefined".to_string(),
+                scopes: Scopes::All,
+                issuer: None,
+            });
+        };
+        Ok(())
+    }
+}
+
+#[derive(Clone)]
+pub struct AuthConfectionary {
+    pub location: String,
+    pub identifier: String,
+    pub key: Vec<u8>,
+    pub root_keys: HashMap<String, Vec<u8>>,
+}
+
+impl AuthConfectionary {
+    pub fn new(
+        location: String,
+        identifier: String,
+        key_base64: String,
+    ) -> Result<AuthConfectionary> {
+        macaroon::initialize().unwrap();
+        let key = BASE64.decode(key_base64.as_bytes())?;
+        let mut root_keys = HashMap::new();
+        root_keys.insert(identifier.clone(), key.clone());
+        Ok(AuthConfectionary {
+            location: location,
+            identifier: identifier,
+            key: key,
+            root_keys: root_keys,
+        })
+    }
+
+    pub fn new_dummy() -> AuthConfectionary {
+        AuthConfectionary::new(
+            "test.fatcat.wiki".to_string(),
+            "dummy".to_string(),
+            BASE64.encode(DUMMY_KEY),
+        )
+        .unwrap()
+    }
+
+    pub fn add_keypair(&mut self, identifier: String, key_base64: String) -> Result<()> {
+        let key = BASE64.decode(key_base64.as_bytes())?;
+        self.root_keys.insert(identifier, key);
+        Ok(())
+    }
+
+    pub fn create_token(
+        &self,
+        editor_id: FatCatId,
+        duration: Option<chrono::Duration>,
+    ) -> Result<String> {
+        let mut mac = Macaroon::create(&self.location, &self.key, &self.identifier)
+            .expect("Macaroon creation");
+        mac.add_first_party_caveat(&format!("editor_id = {}", editor_id.to_string()));
+        let now_utc = Utc::now();
+        let now = now_utc.to_rfc3339_opts(SecondsFormat::Secs, true);
+        mac.add_first_party_caveat(&format!("time > {}", now));
+        if let Some(duration) = duration {
+            let expires = now_utc + duration;
+            mac.add_first_party_caveat(&format!(
+                "time < {:?}",
+                &expires.to_rfc3339_opts(SecondsFormat::Secs, true)
+            ));
+        };
+        let raw = mac.serialize(Format::V2).expect("macaroon serialization");
+        Ok(BASE64.encode(&raw))
+    }
+
+    pub fn parse_macaroon_token(
+        &self,
+        conn: &DbConn,
+        s: &str,
+        endpoint: Option<&str>,
+    ) -> Result<EditorRow> {
+        let raw = BASE64.decode(s.as_bytes())?;
+        let mac = match Macaroon::deserialize(&raw) {
+            Ok(m) => m,
+            Err(e) => {
+                // TODO: should be "chaining" here
+                return Err(ErrorKind::InvalidCredentials(format!(
+                    "macaroon deserialize error: {:?}",
+                    e
+                ))
+                .into());
+            }
+        };
+        let mac = match mac.validate() {
+            Ok(m) => m,
+            Err(e) => {
+                // TODO: should be "chaining" here
+                return Err(ErrorKind::InvalidCredentials(format!(
+                    "macaroon validate error: {:?}",
+                    e
+                ))
+                .into());
+            }
+        };
+        let mut verifier = Verifier::new();
+        let mut editor_id: Option<FatCatId> = None;
+        for caveat in mac.first_party_caveats() {
+            if caveat.predicate().starts_with("editor_id = ") {
+                editor_id = Some(FatCatId::from_str(caveat.predicate().get(12..).unwrap())?);
+                break;
+            }
+        }
+        let editor_id = match editor_id {
+            Some(id) => id,
+            None => {
+                return Err(ErrorKind::InvalidCredentials(
+                    "expected an editor_id caveat".to_string(),
+                )
+                .into());
+            }
+        };
+        verifier.satisfy_exact(&format!("editor_id = {}", editor_id.to_string()));
+        if let Some(endpoint) = endpoint {
+            // API endpoint
+            verifier.satisfy_exact(&format!("endpoint = {}", endpoint));
+        }
+        let mut created: Option<DateTime<Utc>> = None;
+        for caveat in mac.first_party_caveats() {
+            if caveat.predicate().starts_with("time > ") {
+                created = Some(
+                    DateTime::parse_from_rfc3339(caveat.predicate().get(7..).unwrap())
+                        .unwrap()
+                        .with_timezone(&Utc),
+                );
+                break;
+            }
+        }
+        let created = match created {
+            Some(c) => c,
+            None => {
+                return Err(ErrorKind::InvalidCredentials(
+                    "expected a 'created' (time >) caveat".to_string(),
+                )
+                .into());
+            }
+        };
+        verifier.satisfy_exact(&format!(
+            "time > {}",
+            created.to_rfc3339_opts(SecondsFormat::Secs, true)
+        ));
+        let editor: EditorRow = editor::table.find(&editor_id.to_uuid()).get_result(conn)?;
+        let auth_epoch = DateTime::<Utc>::from_utc(editor.auth_epoch, Utc);
+        // allow a second of wiggle room for precision and, eg, tests
+        if created < (auth_epoch - chrono::Duration::seconds(1)) {
+            return Err(ErrorKind::InvalidCredentials(
+                "token created before current auth_epoch (was probably revoked by editor)"
+                    .to_string(),
+            )
+            .into());
+        }
+        verifier.satisfy_general(|p: &str| -> bool {
+            // not expired (based on time)
+            if p.starts_with("time < ") {
+                let expires: DateTime<Utc> = DateTime::parse_from_rfc3339(p.get(7..).unwrap())
+                    .unwrap()
+                    .with_timezone(&Utc);
+                expires < Utc::now()
+            } else {
+                false
+            }
+        });
+        let verify_key = match self.root_keys.get(mac.identifier()) {
+            Some(key) => key,
+            None => {
+                return Err(ErrorKind::InvalidCredentials(format!(
+                    "no valid auth signing key for identifier: {}",
+                    mac.identifier()
+                ))
+                .into());
+            }
+        };
+        match mac.verify(verify_key, &mut verifier) {
+            Ok(true) => (),
+            Ok(false) => {
+                return Err(ErrorKind::InvalidCredentials(
+                    "auth token (macaroon) not valid (signature and/or caveats failed)".to_string(),
+                )
+                .into());
+            }
+            Err(e) => {
+                // TODO: chain
+                return Err(
+                    ErrorKind::InvalidCredentials(format!("token parsing failed: {:?}", e)).into(),
+                );
+            }
+        }
+        Ok(editor)
+    }
+
+    pub fn parse_swagger(
+        &self,
+        conn: &DbConn,
+        auth_data: &Option<AuthData>,
+        endpoint: Option<&str>,
+    ) -> Result<Option<AuthContext>> {
+        let token: Option<String> = match auth_data {
+            Some(AuthData::ApiKey(header)) => {
+                let header: Vec<String> =
+                    header.split_whitespace().map(|s| s.to_string()).collect();
+                if !(header.len() == 2 && header[0] == "Bearer") {
+                    return Err(ErrorKind::InvalidCredentials(
+                        "invalid Bearer Auth HTTP header".to_string(),
+                    )
+                    .into());
+                }
+                Some(header[1].clone())
+            }
+            None => None,
+            _ => {
+                return Err(ErrorKind::InvalidCredentials(
+                    "Authentication HTTP Header should either be empty or a Beaerer API key"
+                        .to_string(),
+                )
+                .into());
+            }
+        };
+        let token = match token {
+            Some(t) => t,
+            None => return Ok(None),
+        };
+        let editor_row = self.parse_macaroon_token(conn, &token, endpoint)?;
+        Ok(Some(AuthContext {
+            editor_id: FatCatId::from_uuid(&editor_row.id),
+            editor_row: editor_row,
+        }))
+    }
+
+    pub fn require_auth(
+        &self,
+        conn: &DbConn,
+        auth_data: &Option<AuthData>,
+        endpoint: Option<&str>,
+    ) -> Result<AuthContext> {
+        match self.parse_swagger(conn, auth_data, endpoint)? {
+            Some(auth) => Ok(auth),
+            None => Err(ErrorKind::InvalidCredentials("no token supplied".to_string()).into()),
+        }
+    }
+
+    // TODO: refactor out of this file?
+    /// Only used from CLI tool
+    pub fn inspect_token(&self, conn: &DbConn, token: &str) -> Result<()> {
+        let raw = BASE64.decode(token.as_bytes())?;
+        let mac = match Macaroon::deserialize(&raw) {
+            Ok(m) => m,
+            Err(e) => bail!("macaroon deserialize error: {:?}", e),
+        };
+        let now = Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true);
+        println!("current time: {}", now);
+        println!("domain (location): {:?}", mac.location());
+        println!("signing key name (identifier): {}", mac.identifier());
+        for caveat in mac.first_party_caveats() {
+            println!("caveat: {}", caveat.predicate());
+        }
+        println!("verify: {:?}", self.parse_macaroon_token(conn, token, None));
+        Ok(())
+    }
+}
+
+pub fn create_key() -> String {
+    let mut key: Vec<u8> = vec![0; 32];
+    for v in key.iter_mut() {
+        *v = rand::random()
+    }
+    BASE64.encode(&key)
+}
+
+pub fn revoke_tokens(conn: &DbConn, editor_id: FatCatId) -> Result<()> {
+    diesel::update(editor::table.filter(editor::id.eq(&editor_id.to_uuid())))
+        .set(editor::auth_epoch.eq(Utc::now()))
+        .execute(conn)?;
+    Ok(())
+}
+
+pub fn revoke_tokens_everyone(conn: &DbConn) -> Result<()> {
+    diesel::update(editor::table)
+        .set(editor::auth_epoch.eq(Utc::now()))
+        .execute(conn)?;
+    Ok(())
+}
+
+// TODO: refactor out of this file?
+/// Only used from CLI tool
+pub fn print_editors(conn: &DbConn) -> Result<()> {
+    // iterate over all editors. format id, print flags, auth_epoch
+    let all_editors: Vec<EditorRow> = editor::table.load(conn)?;
+    println!("editor_id\t\t\tsuper/admin/bot\tauth_epoch\t\t\tusername\twrangler_id");
+    for e in all_editors {
+        println!(
+            "{}\t{}/{}/{}\t{}\t{}\t{:?}",
+            FatCatId::from_uuid(&e.id).to_string(),
+            e.is_superuser,
+            e.is_admin,
+            e.is_bot,
+            e.auth_epoch,
+            e.username,
+            e.wrangler_id,
+        );
+    }
+    Ok(())
+}