128 lines
3.9 KiB
C++
128 lines
3.9 KiB
C++
/*
|
|
* Copyright (C) 2019 Emeric Poupon
|
|
*
|
|
* This file is part of LMS.
|
|
*
|
|
* LMS is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* LMS is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
/* This file contains some classes in order to get info from file using the libavconv */
|
|
|
|
#include "AuthTokenService.hpp"
|
|
|
|
#include <Wt/Auth/HashFunction.h>
|
|
#include <Wt/Auth/PasswordStrengthValidator.h>
|
|
#include <Wt/WRandom.h>
|
|
|
|
#include "database/Session.hpp"
|
|
#include "database/User.hpp"
|
|
#include "utils/Exception.hpp"
|
|
#include "utils/Logger.hpp"
|
|
|
|
namespace Auth {
|
|
|
|
std::unique_ptr<IAuthTokenService> createAuthTokenService(std::size_t maxThrottlerEntries)
|
|
{
|
|
return std::make_unique<AuthTokenService>(maxThrottlerEntries);
|
|
}
|
|
|
|
static const Wt::Auth::SHA1HashFunction sha1Function;
|
|
|
|
AuthTokenService::AuthTokenService(std::size_t maxThrottlerEntries)
|
|
: _loginThrottler {maxThrottlerEntries}
|
|
{
|
|
}
|
|
|
|
std::string
|
|
AuthTokenService::createAuthToken(Database::Session& session, Database::IdType userId, const Wt::WDateTime& expiry)
|
|
{
|
|
const std::string secret {Wt::WRandom::generateId(32)};
|
|
const std::string secretHash {sha1Function.compute(secret, {})};
|
|
|
|
auto transaction {session.createUniqueTransaction()};
|
|
|
|
Database::User::pointer user {Database::User::getById(session, userId)};
|
|
if (!user)
|
|
throw LmsException {"User deleted"};
|
|
|
|
Database::AuthToken::pointer authToken {Database::AuthToken::create(session, secretHash, expiry, user)};
|
|
|
|
LMS_LOG(UI, DEBUG) << "Created auth token for user '" << user->getLoginName() << "', expiry = " << expiry.toString();
|
|
|
|
if (user->getAuthTokensCount() >= 50)
|
|
Database::AuthToken::removeExpiredTokens(session, Wt::WDateTime::currentDateTime());
|
|
|
|
return secret;
|
|
}
|
|
|
|
static
|
|
std::optional<AuthTokenService::AuthTokenProcessResult::AuthTokenInfo>
|
|
processAuthToken(Database::Session& session, const std::string& secret)
|
|
{
|
|
const std::string secretHash {sha1Function.compute(secret, {})};
|
|
|
|
auto transaction {session.createUniqueTransaction()};
|
|
|
|
Database::AuthToken::pointer authToken {Database::AuthToken::getByValue(session, secretHash)};
|
|
if (!authToken)
|
|
return std::nullopt;
|
|
|
|
if (authToken->getExpiry() < Wt::WDateTime::currentDateTime())
|
|
{
|
|
authToken.remove();
|
|
return std::nullopt;
|
|
}
|
|
|
|
LMS_LOG(UI, DEBUG) << "Found auth token for user '" << authToken->getUser()->getLoginName() << "'!";
|
|
|
|
AuthTokenService::AuthTokenProcessResult::AuthTokenInfo res {authToken->getUser().id(), authToken->getExpiry()};
|
|
authToken.remove();
|
|
|
|
return res;
|
|
}
|
|
|
|
|
|
AuthTokenService::AuthTokenProcessResult
|
|
AuthTokenService::processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& tokenValue)
|
|
{
|
|
// Do not waste too much resource on brute force attacks (optim)
|
|
{
|
|
std::shared_lock<std::shared_timed_mutex> lock {_mutex};
|
|
|
|
if (_loginThrottler.isClientThrottled(clientAddress))
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
|
|
}
|
|
|
|
auto res {Auth::processAuthToken(session, tokenValue)};
|
|
{
|
|
std::unique_lock<std::shared_timed_mutex> lock {_mutex};
|
|
|
|
if (_loginThrottler.isClientThrottled(clientAddress))
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
|
|
|
|
if (!res)
|
|
{
|
|
_loginThrottler.onBadClientAttempt(clientAddress);
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::NotFound};
|
|
}
|
|
|
|
_loginThrottler.onGoodClientAttempt(clientAddress);
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Found, std::move(*res)};
|
|
}
|
|
}
|
|
|
|
|
|
} // namespace Auth
|
|
|