From 100d0f55a5b0d93f78f2cdbad8912aa3199fde45 Mon Sep 17 00:00:00 2001
From: emeric <itmfr@yahoo.fr>
Date: Tue, 7 Jul 2020 10:54:40 +0200
Subject: [PATCH] Added a way to create the admin account linked to the PAM
 backend password authentication. ref #65

---
 README.md                              |  1 +
 approot/admin-initwizard.xml           | 11 +++-
 src/libs/auth/impl/PasswordService.cpp |  1 +
 src/libs/auth/impl/pam/PAM.cpp         |  1 +
 src/lms/CMakeLists.txt                 |  1 +
 src/lms/ui/admin/InitWizardView.cpp    | 85 +++++++++++++++++++++-----
 src/lms/ui/admin/UserView.cpp          | 17 ++----
 src/lms/ui/common/AuthModeModel.cpp    | 42 +++++++++++++
 src/lms/ui/common/AuthModeModel.hpp    | 31 ++++++++++
 src/lms/ui/common/ValueStringModel.hpp |  1 -
 10 files changed, 160 insertions(+), 31 deletions(-)
 create mode 100644 src/lms/ui/common/AuthModeModel.cpp
 create mode 100644 src/lms/ui/common/AuthModeModel.hpp

diff --git a/README.md b/README.md
index d8e1773e..77a88de6 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,7 @@ A [demo](http://lms.demo.poupon.io) instance is available, with the following li
 * MusicBrainzID support to handle duplicated artist and release names
 * Disc subtitles support
 * _Systemd_ integration
+* _PAM_ authentication backend
 * Subsonic API, with the following additional features:
   * Playlists
   * Starred Album/Artist/Tracks
diff --git a/approot/admin-initwizard.xml b/approot/admin-initwizard.xml
index d9ca837a..dce9da57 100644
--- a/approot/admin-initwizard.xml
+++ b/approot/admin-initwizard.xml
@@ -20,7 +20,15 @@
 								${admin-login-info class="help-block"}
 							</div>
 						</div>
-
+						<div class="form-group">
+							<label class="control-label col-lg-3"  for="${id:auth-mode}">
+								${tr:Lms.Admin.User.auth-mode}
+							</label>
+							<div class="col-lg-9">
+								${auth-mode}
+								${auth-mode-info class="help-block"}
+							</div>
+						</div>
 						<div class="form-group">
 							<label class="col-lg-3 control-label"  for="${id:password}">
 								${tr:Lms.password}
@@ -30,7 +38,6 @@
 								${password-info class="help-block"}
 							</div>
 						</div>
-
 						<div class="form-group">
 							<label class="col-lg-3 control-label"  for="${id:password-confirm}">
 								${tr:Lms.password-confirm}
diff --git a/src/libs/auth/impl/PasswordService.cpp b/src/libs/auth/impl/PasswordService.cpp
index af57f5ae..3ee4d932 100644
--- a/src/libs/auth/impl/PasswordService.cpp
+++ b/src/libs/auth/impl/PasswordService.cpp
@@ -81,6 +81,7 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
 	{
 		case Database::User::AuthMode::Internal:
 		{
+			LMS_LOG(AUTH, DEBUG) << "Checking internal password for user '" << loginName << "'";
 			const Wt::Auth::BCryptHashFunction hashFunc {6}; // TODO parametrize this
 			return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
 		}
diff --git a/src/libs/auth/impl/pam/PAM.cpp b/src/libs/auth/impl/pam/PAM.cpp
index 93869d3f..c0bf6200 100644
--- a/src/libs/auth/impl/pam/PAM.cpp
+++ b/src/libs/auth/impl/pam/PAM.cpp
@@ -164,6 +164,7 @@ checkUserPassword(const std::string& loginName, const std::string& password)
 {
 	try
 	{
+		LMS_LOG(AUTH, DEBUG) << "Checking PAM password for user '" << loginName << "'";
 		PAMContext pamContext {loginName};
 
 		pamContext.authenticate(password);
diff --git a/src/lms/CMakeLists.txt b/src/lms/CMakeLists.txt
index 3cb6a7be..40fb59bf 100644
--- a/src/lms/CMakeLists.txt
+++ b/src/lms/CMakeLists.txt
@@ -14,6 +14,7 @@ add_executable(lms
 	ui/admin/InitWizardView.cpp
 	ui/admin/UserView.cpp
 	ui/admin/UsersView.cpp
+	ui/common/AuthModeModel.cpp
 	ui/common/Validators.cpp
 	ui/explore/ArtistListHelpers.cpp
 	ui/explore/ArtistView.cpp
diff --git a/src/lms/ui/admin/InitWizardView.cpp b/src/lms/ui/admin/InitWizardView.cpp
index a9f3cc3f..a14a386e 100644
--- a/src/lms/ui/admin/InitWizardView.cpp
+++ b/src/lms/ui/admin/InitWizardView.cpp
@@ -19,6 +19,7 @@
 
 #include "InitWizardView.hpp"
 
+#include <Wt/WComboBox.h>
 #include <Wt/WFormModel.h>
 #include <Wt/WLineEdit.h>
 #include <Wt/WPushButton.h>
@@ -29,6 +30,7 @@
 #include "utils/Service.hpp"
 
 #include "common/Validators.hpp"
+#include "common/AuthModeModel.hpp"
 #include "LmsApplication.hpp"
 
 namespace UserInterface {
@@ -41,18 +43,23 @@ class InitWizardModel : public Wt::WFormModel
 		static const Field AdminLoginField;
 		static const Field PasswordField;
 		static const Field PasswordConfirmField;
+		static inline const Field AuthModeField{"auth-mode"};
 
 		InitWizardModel() : Wt::WFormModel()
 		{
 			addField(AdminLoginField);
+			addField(AuthModeField);
 			addField(PasswordField);
 			addField(PasswordConfirmField);
 
+			setValidator(AuthModeField, createMandatoryValidator());
 			setValidator(AdminLoginField, createNameValidator());
 			setValidator(PasswordField, createMandatoryValidator());
 			setValidator(PasswordConfirmField, createMandatoryValidator());
 		}
 
+		std::shared_ptr<AuthModeModel> getAuthModeModel() const { return _authModeModel; }
+
 		void saveData()
 		{
 			const Database::User::PasswordHash passwordHash {ServiceProvider<::Auth::IPasswordService>::get()->hashPassword(valueText(PasswordField).toUTF8())};
@@ -64,10 +71,54 @@ class InitWizardModel : public Wt::WFormModel
 			if (!Database::User::getAll(LmsApp->getDbSession()).empty())
 				throw LmsException("Admin user already created");
 
+			auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+			if (!authModeRow)
+				throw LmsException {"Bad authentication mode"};
+
+			const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+
 			Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8())};
 			user.modify()->setType(Database::User::Type::ADMIN);
-			user.modify()->setAuthMode(Database::User::AuthMode::Internal);
-			user.modify()->setPasswordHash(passwordHash);
+			user.modify()->setAuthMode(authMode);
+			if (authMode == Database::User::AuthMode::Internal)
+				user.modify()->setPasswordHash(passwordHash);
+		}
+
+		void validatePassword(Wt::WString& error) const
+		{
+			auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+			if (!authModeRow)
+				throw LmsException {"Bad authentication mode"};
+
+			const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+			if (authMode != Database::User::AuthMode::Internal)
+				return;
+
+			if (!valueText(PasswordField).empty())
+			{
+				// Evaluate the strength of the password
+				if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(valueText(AdminLoginField).toUTF8(), valueText(PasswordField).toUTF8()))
+					error = Wt::WString::tr("Lms.password-too-weak");
+			}
+			else
+				error = Wt::WString::tr("Lms.password-must-not-be-empty");
+		}
+
+		void validatePasswordConfirm(Wt::WString& error) const
+		{
+			auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+			if (!authModeRow)
+				throw LmsException {"Bad authentication mode"};
+
+			const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+			if (authMode != Database::User::AuthMode::Internal)
+				return;
+
+			if (validation(PasswordField).state() == Wt::ValidationState::Valid)
+			{
+				if (valueText(PasswordField) != valueText(PasswordConfirmField))
+					error = Wt::WString::tr("Lms.passwords-dont-match");
+			}
 		}
 
 		bool validateField(Field field)
@@ -76,22 +127,11 @@ class InitWizardModel : public Wt::WFormModel
 
 			if (field == PasswordField)
 			{
-				if (!valueText(PasswordField).empty())
-				{
-					// Evaluate the strength of the password
-					if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(valueText(AdminLoginField).toUTF8(), valueText(PasswordField).toUTF8()))
-						error = Wt::WString::tr("Lms.password-too-weak");
-				}
-				else
-					return Wt::WFormModel::validateField(field);
+				validatePassword(error);
 			}
 			else if (field == PasswordConfirmField)
 			{
-				if (validation(PasswordField).state() == Wt::ValidationState::Valid)
-				{
-					if (valueText(PasswordField) != valueText(PasswordConfirmField))
-						error = Wt::WString::tr("Lms.passwords-dont-match");
-				}
+				validatePasswordConfirm(error);
 			}
 			else
 			{
@@ -103,6 +143,7 @@ class InitWizardModel : public Wt::WFormModel
 			return (validation(field).state() == Wt::ValidationState::Valid);
 		}
 
+		std::shared_ptr<AuthModeModel>	_authModeModel {createAuthModeModel()};
 };
 
 const Wt::WFormModel::Field InitWizardModel::AdminLoginField = "admin-login";
@@ -121,6 +162,20 @@ InitWizardView::InitWizardView()
 		setFormWidget(InitWizardModel::AdminLoginField, std::move(adminLogin));
 	}
 
+	// Auth mode
+	auto authMode = std::make_unique<Wt::WComboBox>();
+	authMode->setModel(model->getAuthModeModel());
+	authMode->activated().connect([=](int row)
+	{
+		const Database::User::AuthMode authMode {model->getAuthModeModel()->getValue(row)};
+
+		model->setReadOnly(InitWizardModel::PasswordField, authMode != Database::User::AuthMode::Internal);
+		model->setReadOnly(InitWizardModel::PasswordConfirmField, authMode != Database::User::AuthMode::Internal);
+		updateModel(model.get());
+		updateView(model.get());
+	});
+	setFormWidget(InitWizardModel::AuthModeField, std::move(authMode));
+
 	// Password
 	{
 		auto passwordEdit = std::make_unique<Wt::WLineEdit>();
diff --git a/src/lms/ui/admin/UserView.cpp b/src/lms/ui/admin/UserView.cpp
index 909af333..5255cd60 100644
--- a/src/lms/ui/admin/UserView.cpp
+++ b/src/lms/ui/admin/UserView.cpp
@@ -35,6 +35,7 @@
 #include "utils/Service.hpp"
 #include "utils/String.hpp"
 
+#include "common/AuthModeModel.hpp"
 #include "common/Validators.hpp"
 #include "common/ValueStringModel.hpp"
 #include "LmsApplication.hpp"
@@ -58,8 +59,6 @@ class UserModel : public Wt::WFormModel
 		UserModel(std::optional<Database::IdType> userId)
 		: _userId {userId}
 		{
-			initializeModels();
-
 			if (!_userId)
 			{
 				addField(LoginField);
@@ -70,6 +69,8 @@ class UserModel : public Wt::WFormModel
 			addField(PasswordField);
 			addField(DemoField);
 
+			setValidator(AuthModeField, createMandatoryValidator());
+
 			loadData();
 		}
 
@@ -234,18 +235,8 @@ class UserModel : public Wt::WFormModel
 			return false;
 		}
 
-		void initializeModels()
-		{
-			_authModeModel = std::make_shared<AuthModeModel>();
-
-			if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::Internal))
-				_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.internal"), User::AuthMode::Internal);
-			if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::PAM))
-				_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.pam"), User::AuthMode::PAM);
-		}
-
 		std::optional<Database::IdType> _userId;
-		std::shared_ptr<AuthModeModel>	_authModeModel;
+		std::shared_ptr<AuthModeModel>	_authModeModel {createAuthModeModel()};
 };
 
 UserView::UserView()
diff --git a/src/lms/ui/common/AuthModeModel.cpp b/src/lms/ui/common/AuthModeModel.cpp
new file mode 100644
index 00000000..1a74b440
--- /dev/null
+++ b/src/lms/ui/common/AuthModeModel.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2020 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "AuthModeModel.hpp"
+
+#include "auth/IPasswordService.hpp"
+#include "utils/Service.hpp"
+
+namespace UserInterface
+{
+
+std::unique_ptr<AuthModeModel>
+createAuthModeModel()
+{
+	auto model {std::make_unique<AuthModeModel>()};
+
+	if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(Database::User::AuthMode::Internal))
+		model->add(Wt::WString::tr("Lms.Admin.User.auth-mode.internal"), Database::User::AuthMode::Internal);
+	if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(Database::User::AuthMode::PAM))
+		model->add(Wt::WString::tr("Lms.Admin.User.auth-mode.pam"), Database::User::AuthMode::PAM);
+
+	return model;
+}
+
+}
+
diff --git a/src/lms/ui/common/AuthModeModel.hpp b/src/lms/ui/common/AuthModeModel.hpp
new file mode 100644
index 00000000..171f1034
--- /dev/null
+++ b/src/lms/ui/common/AuthModeModel.hpp
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2020 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "database/User.hpp"
+#include "common/ValueStringModel.hpp"
+
+namespace UserInterface
+{
+	using AuthModeModel = ValueStringModel<Database::User::AuthMode>;
+
+	std::unique_ptr<AuthModeModel> createAuthModeModel();
+}
+
diff --git a/src/lms/ui/common/ValueStringModel.hpp b/src/lms/ui/common/ValueStringModel.hpp
index 821016cf..333694f4 100644
--- a/src/lms/ui/common/ValueStringModel.hpp
+++ b/src/lms/ui/common/ValueStringModel.hpp
@@ -1,4 +1,3 @@
-
 /*
  * Copyright (C) 2019 Emeric Poupon
  *