144 lines
4.4 KiB
C++
144 lines
4.4 KiB
C++
/*
|
|
* Copyright (C) 2019 Emeric Poupon
|
|
*
|
|
* This file is part of LMS.
|
|
*
|
|
* LMS is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* LMS is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "AuthTokenService.hpp"
|
|
|
|
#include <Wt/Auth/HashFunction.h>
|
|
#include <Wt/Auth/PasswordStrengthValidator.h>
|
|
#include <Wt/WRandom.h>
|
|
|
|
#include "services/auth/Types.hpp"
|
|
#include "services/database/AuthToken.hpp"
|
|
#include "services/database/Session.hpp"
|
|
#include "services/database/User.hpp"
|
|
#include "utils/Exception.hpp"
|
|
#include "utils/Logger.hpp"
|
|
|
|
namespace Auth
|
|
{
|
|
|
|
std::unique_ptr<IAuthTokenService> createAuthTokenService(Database::Db& db, std::size_t maxThrottlerEntries)
|
|
{
|
|
return std::make_unique<AuthTokenService>(db, maxThrottlerEntries);
|
|
}
|
|
|
|
static const Wt::Auth::SHA1HashFunction sha1Function;
|
|
|
|
AuthTokenService::AuthTokenService(Database::Db& db, std::size_t maxThrottlerEntries)
|
|
: AuthServiceBase {db}
|
|
, _loginThrottler {maxThrottlerEntries}
|
|
{
|
|
}
|
|
|
|
std::string
|
|
AuthTokenService::createAuthToken(Database::UserId userId, const Wt::WDateTime& expiry)
|
|
{
|
|
const std::string secret {Wt::WRandom::generateId(32)};
|
|
const std::string secretHash {sha1Function.compute(secret, {})};
|
|
|
|
Database::Session& session {getDbSession()};
|
|
|
|
auto transaction {session.createUniqueTransaction()};
|
|
|
|
Database::User::pointer user {Database::User::find(session, userId)};
|
|
if (!user)
|
|
throw Exception {"User deleted"};
|
|
|
|
Database::AuthToken::pointer authToken {session.create<Database::AuthToken>(secretHash, expiry, user)};
|
|
|
|
LMS_LOG(UI, DEBUG) << "Created auth token for user '" << user->getLoginName() << "', expiry = " << expiry.toString();
|
|
|
|
if (user->getAuthTokensCount() >= 50)
|
|
Database::AuthToken::removeExpiredTokens(session, Wt::WDateTime::currentDateTime());
|
|
|
|
return secret;
|
|
}
|
|
|
|
std::optional<AuthTokenService::AuthTokenProcessResult::AuthTokenInfo>
|
|
AuthTokenService::processAuthToken(std::string_view secret)
|
|
{
|
|
const std::string secretHash {sha1Function.compute(std::string {secret}, {})};
|
|
|
|
Database::Session& session {getDbSession()};
|
|
auto transaction {session.createUniqueTransaction()};
|
|
|
|
Database::AuthToken::pointer authToken {Database::AuthToken::find(session, secretHash)};
|
|
if (!authToken)
|
|
return std::nullopt;
|
|
|
|
if (authToken->getExpiry() < Wt::WDateTime::currentDateTime())
|
|
{
|
|
authToken.remove();
|
|
return std::nullopt;
|
|
}
|
|
|
|
LMS_LOG(UI, DEBUG) << "Found auth token for user '" << authToken->getUser()->getLoginName() << "'!";
|
|
|
|
AuthTokenService::AuthTokenProcessResult::AuthTokenInfo res {authToken->getUser()->getId(), authToken->getExpiry()};
|
|
authToken.remove();
|
|
|
|
return res;
|
|
}
|
|
|
|
AuthTokenService::AuthTokenProcessResult
|
|
AuthTokenService::processAuthToken(const boost::asio::ip::address& clientAddress, std::string_view tokenValue)
|
|
{
|
|
// Do not waste too much resource on brute force attacks (optim)
|
|
{
|
|
std::shared_lock lock {_mutex};
|
|
|
|
if (_loginThrottler.isClientThrottled(clientAddress))
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
|
|
}
|
|
|
|
auto res {processAuthToken(tokenValue)};
|
|
{
|
|
std::unique_lock lock {_mutex};
|
|
|
|
if (_loginThrottler.isClientThrottled(clientAddress))
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
|
|
|
|
if (!res)
|
|
{
|
|
_loginThrottler.onBadClientAttempt(clientAddress);
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Denied};
|
|
}
|
|
|
|
_loginThrottler.onGoodClientAttempt(clientAddress);
|
|
onUserAuthenticated(res->userId);
|
|
return AuthTokenProcessResult {AuthTokenProcessResult::State::Granted, std::move(*res)};
|
|
}
|
|
}
|
|
|
|
void
|
|
AuthTokenService::clearAuthTokens(Database::UserId userId)
|
|
{
|
|
Database::Session& session {getDbSession()};
|
|
|
|
auto transaction {session.createUniqueTransaction()};
|
|
|
|
Database::User::pointer user {Database::User::find(session, userId)};
|
|
if (!user)
|
|
throw Exception {"User deleted"};
|
|
|
|
user.modify()->clearAuthTokens();
|
|
}
|
|
|
|
} // namespace Auth
|