mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-06-12 21:27:37 +02:00
First working version
This commit is contained in:
Daniel García
149
src/api/core/accounts.rs
Normal file
149
src/api/core/accounts.rs
Normal file
@ -0,0 +1,149 @@
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
use CONFIG;
|
||||
|
||||
#[derive(Deserialize, Debug)]
|
||||
#[allow(non_snake_case)]
|
||||
struct RegisterData {
|
||||
email: String,
|
||||
key: String,
|
||||
keys: Option<KeysData>,
|
||||
masterPasswordHash: String,
|
||||
masterPasswordHint: Option<String>,
|
||||
name: Option<String>,
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Debug)]
|
||||
#[allow(non_snake_case)]
|
||||
struct KeysData {
|
||||
encryptedPrivateKey: String,
|
||||
publicKey: String,
|
||||
}
|
||||
|
||||
#[post("/accounts/register", data = "<data>")]
|
||||
fn register(data: Json<RegisterData>, conn: DbConn) -> Result<(), BadRequest<Json>> {
|
||||
if CONFIG.signups_allowed {
|
||||
err!(format!("Signups not allowed"))
|
||||
}
|
||||
println!("DEBUG - {:#?}", data);
|
||||
|
||||
if let Some(_) = User::find_by_mail(&data.email, &conn) {
|
||||
err!("Email already exists")
|
||||
}
|
||||
|
||||
let mut user = User::new(data.email.clone(),
|
||||
data.key.clone(),
|
||||
data.masterPasswordHash.clone());
|
||||
|
||||
// Add extra fields if present
|
||||
if let Some(name) = data.name.clone() {
|
||||
user.name = name;
|
||||
}
|
||||
|
||||
if let Some(hint) = data.masterPasswordHint.clone() {
|
||||
user.password_hint = Some(hint);
|
||||
}
|
||||
|
||||
if let Some(ref keys) = data.keys {
|
||||
user.private_key = Some(keys.encryptedPrivateKey.clone());
|
||||
user.public_key = Some(keys.publicKey.clone());
|
||||
}
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[get("/accounts/profile")]
|
||||
fn profile(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
Ok(Json(headers.user.to_json()))
|
||||
}
|
||||
|
||||
#[post("/accounts/keys", data = "<data>")]
|
||||
fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut user = headers.user;
|
||||
|
||||
user.private_key = Some(data.encryptedPrivateKey.clone());
|
||||
user.public_key = Some(data.publicKey.clone());
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(user.to_json()))
|
||||
}
|
||||
|
||||
#[post("/accounts/password", data = "<data>")]
|
||||
fn post_password(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let key = data["key"].as_str().unwrap();
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
let new_password_hash = data["newMasterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
user.set_password(new_password_hash);
|
||||
user.key = key.to_string();
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(json!({})))
|
||||
}
|
||||
|
||||
#[post("/accounts/security-stamp", data = "<data>")]
|
||||
fn post_sstamp(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
user.reset_security_stamp();
|
||||
|
||||
Ok(Json(json!({})))
|
||||
}
|
||||
|
||||
#[post("/accounts/email-token", data = "<data>")]
|
||||
fn post_email(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
println!("{:#?}", data);
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/accounts/delete", data = "<data>")]
|
||||
fn delete_account(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[get("/accounts/revision-date")]
|
||||
fn revision_date(headers: Headers, conn: DbConn) -> Result<String, BadRequest<Json>> {
|
||||
let revision_date = headers.user.updated_at.timestamp();
|
||||
Ok(revision_date.to_string())
|
||||
}
|
||||
251
src/api/core/ciphers.rs
Normal file
251
src/api/core/ciphers.rs
Normal file
@ -0,0 +1,251 @@
|
||||
use std::io::{Cursor, Read};
|
||||
|
||||
use rocket::{Route, Data};
|
||||
use rocket::http::ContentType;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use multipart::server::Multipart;
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
#[get("/sync")]
|
||||
fn sync(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let user = headers.user;
|
||||
|
||||
let folders = Folder::find_by_user(&user.uuid, &conn);
|
||||
let folders_json: Vec<Value> = folders.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
let ciphers = Cipher::find_by_user(&user.uuid, &conn);
|
||||
let ciphers_json: Vec<Value> = ciphers.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
Ok(Json(json!({
|
||||
"Profile": user.to_json(),
|
||||
"Folders": folders_json,
|
||||
"Ciphers": ciphers_json,
|
||||
"Domains": {
|
||||
"EquivalentDomains": [],
|
||||
"GlobalEquivalentDomains": [],
|
||||
"Object": "domains",
|
||||
},
|
||||
"Object": "sync"
|
||||
})))
|
||||
}
|
||||
|
||||
|
||||
#[get("/ciphers")]
|
||||
fn get_ciphers(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let ciphers = Cipher::find_by_user(&headers.user.uuid, &conn);
|
||||
|
||||
let ciphers_json: Vec<Value> = ciphers.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
Ok(Json(json!({
|
||||
"Data": ciphers_json,
|
||||
"Object": "list",
|
||||
})))
|
||||
}
|
||||
|
||||
#[get("/ciphers/<uuid>")]
|
||||
fn get_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let cipher = match Cipher::find_by_uuid(&uuid, &conn) {
|
||||
Some(cipher) => cipher,
|
||||
None => err!("Cipher doesn't exist")
|
||||
};
|
||||
|
||||
if cipher.user_uuid != headers.user.uuid {
|
||||
err!("Cipher is now owned by user")
|
||||
}
|
||||
|
||||
Ok(Json(cipher.to_json()))
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Debug)]
|
||||
#[allow(non_snake_case)]
|
||||
struct CipherData {
|
||||
#[serde(rename = "type")]
|
||||
type_: i32,
|
||||
folderId: Option<String>,
|
||||
organizationId: Option<String>,
|
||||
name: Option<String>,
|
||||
notes: Option<String>,
|
||||
favorite: Option<bool>,
|
||||
login: Option<Value>,
|
||||
card: Option<Value>,
|
||||
fields: Option<Vec<Value>>,
|
||||
}
|
||||
|
||||
#[post("/ciphers", data = "<data>")]
|
||||
fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut cipher = Cipher::new(headers.user.uuid.clone(),
|
||||
data.type_,
|
||||
data.favorite.unwrap_or(false));
|
||||
|
||||
if let Some(ref folder_id) = data.folderId {
|
||||
// TODO: Validate folder is owned by user
|
||||
cipher.folder_uuid = Some(folder_id.clone());
|
||||
}
|
||||
|
||||
if let Some(ref org_id) = data.organizationId {
|
||||
cipher.organization_uuid = Some(org_id.clone());
|
||||
}
|
||||
|
||||
cipher.data = match value_from_data(&data) {
|
||||
Ok(value) => {
|
||||
use serde_json;
|
||||
println!("--- {:?}", serde_json::to_string(&value));
|
||||
println!("--- {:?}", value.to_string());
|
||||
|
||||
value.to_string()
|
||||
}
|
||||
Err(msg) => err!(msg)
|
||||
};
|
||||
|
||||
cipher.save(&conn);
|
||||
|
||||
Ok(Json(cipher.to_json()))
|
||||
}
|
||||
|
||||
fn value_from_data(data: &CipherData) -> Result<Value, &'static str> {
|
||||
let mut values = json!({
|
||||
"Name": data.name,
|
||||
"Notes": data.notes
|
||||
});
|
||||
|
||||
match data.type_ {
|
||||
1 /*Login*/ => {
|
||||
let login_data = match data.login {
|
||||
Some(ref login) => login.clone(),
|
||||
None => return Err("Login data missing")
|
||||
};
|
||||
|
||||
if !copy_values(&login_data, &mut values) {
|
||||
return Err("Login data invalid");
|
||||
}
|
||||
}
|
||||
3 /*Card*/ => {
|
||||
let card_data = match data.card {
|
||||
Some(ref card) => card.clone(),
|
||||
None => return Err("Card data missing")
|
||||
};
|
||||
|
||||
if !copy_values(&card_data, &mut values) {
|
||||
return Err("Card data invalid");
|
||||
}
|
||||
}
|
||||
_ => return Err("Unknown type")
|
||||
}
|
||||
|
||||
if let Some(ref fields) = data.fields {
|
||||
values["Fields"] = Value::Array(fields.iter().map(|f| {
|
||||
use std::collections::BTreeMap;
|
||||
use serde_json;
|
||||
|
||||
let empty_map: BTreeMap<String, Value> = BTreeMap::new();
|
||||
let mut value = serde_json::to_value(empty_map).unwrap();
|
||||
|
||||
copy_values(&f, &mut value);
|
||||
|
||||
value
|
||||
}).collect());
|
||||
} else {
|
||||
values["Fields"] = Value::Null;
|
||||
}
|
||||
|
||||
Ok(values)
|
||||
}
|
||||
|
||||
fn copy_values(from: &Value, to: &mut Value) -> bool {
|
||||
let map = match from.as_object() {
|
||||
Some(map) => map,
|
||||
None => return false
|
||||
};
|
||||
|
||||
for (key, val) in map {
|
||||
to[util::upcase_first(key)] = val.clone();
|
||||
}
|
||||
|
||||
true
|
||||
}
|
||||
|
||||
#[post("/ciphers/import", data = "<data>")]
|
||||
fn post_ciphers_import(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
println!("{:#?}", data);
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/ciphers/<uuid>/attachment", format = "multipart/form-data", data = "<data>")]
|
||||
fn post_attachment(uuid: String, data: Data, content_type: &ContentType, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
// TODO: Check if cipher exists
|
||||
|
||||
let mut params = content_type.params();
|
||||
let boundary_pair = params.next().expect("No boundary provided"); // ("boundary", "----WebKitFormBoundary...")
|
||||
let boundary = boundary_pair.1;
|
||||
|
||||
use data_encoding::BASE64URL;
|
||||
use crypto;
|
||||
use CONFIG;
|
||||
|
||||
// TODO: Maybe use the same format as the official server?
|
||||
let attachment_id = BASE64URL.encode(&crypto::get_random_64());
|
||||
let path = format!("{}/{}/{}", CONFIG.attachments_folder,
|
||||
headers.user.uuid, attachment_id);
|
||||
println!("Path {:#?}", path);
|
||||
|
||||
let mut mp = Multipart::with_body(data.open(), boundary);
|
||||
match mp.save().with_dir(path).into_entries() {
|
||||
Some(entries) => {
|
||||
println!("Entries {:#?}", entries);
|
||||
|
||||
let saved_file = &entries.files["data"][0]; // Only one file at a time
|
||||
let file_name = &saved_file.filename; // This is provided by the client, don't trust it
|
||||
let file_size = &saved_file.size;
|
||||
}
|
||||
None => err!("No data entries")
|
||||
}
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[delete("/ciphers/<uuid>/attachment/<attachment_id>")]
|
||||
fn delete_attachment(uuid: String, attachment_id: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
if uuid != headers.user.uuid {
|
||||
err!("Permission denied")
|
||||
}
|
||||
|
||||
// Delete file
|
||||
|
||||
// Delete entry in cipher
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/ciphers/<uuid>")]
|
||||
fn post_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
put_cipher(uuid, headers, conn)
|
||||
}
|
||||
|
||||
#[put("/ciphers/<uuid>")]
|
||||
fn put_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
#[delete("/ciphers/<uuid>")]
|
||||
fn delete_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
#[post("/ciphers/delete", data = "<data>")]
|
||||
fn delete_all(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
// Cipher::delete_from_user(&conn);
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
102
src/api/core/folders.rs
Normal file
102
src/api/core/folders.rs
Normal file
@ -0,0 +1,102 @@
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
#[get("/folders")]
|
||||
fn get_folders(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let folders = Folder::find_by_user(&headers.user.uuid, &conn);
|
||||
|
||||
let folders_json: Vec<Value> = folders.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
Ok(Json(json!({
|
||||
"Data": folders_json,
|
||||
"Object": "list",
|
||||
})))
|
||||
}
|
||||
|
||||
#[get("/folders/<uuid>")]
|
||||
fn get_folder(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut folder = match Folder::find_by_uuid(&uuid, &conn) {
|
||||
Some(folder) => folder,
|
||||
_ => err!("Invalid folder")
|
||||
};
|
||||
|
||||
if folder.user_uuid != headers.user.uuid {
|
||||
err!("Folder belongs to another user")
|
||||
}
|
||||
|
||||
Ok(Json(folder.to_json()))
|
||||
}
|
||||
|
||||
#[post("/folders", data = "<data>")]
|
||||
fn post_folders(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let name = &data["name"].as_str();
|
||||
|
||||
if name.is_none() {
|
||||
err!("Invalid name")
|
||||
}
|
||||
|
||||
let folder = Folder::new(headers.user.uuid.clone(), name.unwrap().into());
|
||||
|
||||
folder.save(&conn);
|
||||
|
||||
Ok(Json(folder.to_json()))
|
||||
}
|
||||
|
||||
#[post("/folders/<uuid>", data = "<data>")]
|
||||
fn post_folder(uuid: String, data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
put_folder(uuid, data, headers, conn)
|
||||
}
|
||||
|
||||
#[put("/folders/<uuid>", data = "<data>")]
|
||||
fn put_folder(uuid: String, data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut folder = match Folder::find_by_uuid(&uuid, &conn) {
|
||||
Some(folder) => folder,
|
||||
_ => err!("Invalid folder")
|
||||
};
|
||||
|
||||
if folder.user_uuid != headers.user.uuid {
|
||||
err!("Folder belongs to another user")
|
||||
}
|
||||
|
||||
let name = &data["name"].as_str();
|
||||
|
||||
if name.is_none() {
|
||||
err!("Invalid name")
|
||||
}
|
||||
|
||||
folder.name = name.unwrap().into();
|
||||
|
||||
folder.save(&conn);
|
||||
|
||||
Ok(Json(folder.to_json()))
|
||||
}
|
||||
|
||||
#[post("/folders/<uuid>/delete", data = "<data>")]
|
||||
fn delete_folder_post(uuid: String, data: Json<Value>, headers: Headers, conn: DbConn) -> Result<(), BadRequest<Json>> {
|
||||
// Data contains a json object with the id, but we don't need it
|
||||
delete_folder(uuid, headers, conn)
|
||||
}
|
||||
|
||||
#[delete("/folders/<uuid>")]
|
||||
fn delete_folder(uuid: String, headers: Headers, conn: DbConn) -> Result<(), BadRequest<Json>> {
|
||||
let folder = match Folder::find_by_uuid(&uuid, &conn) {
|
||||
Some(folder) => folder,
|
||||
_ => err!("Invalid folder")
|
||||
};
|
||||
|
||||
if folder.user_uuid != headers.user.uuid {
|
||||
err!("Folder belongs to another user")
|
||||
}
|
||||
|
||||
folder.delete(&conn);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
100
src/api/core/mod.rs
Normal file
100
src/api/core/mod.rs
Normal file
@ -0,0 +1,100 @@
|
||||
mod accounts;
|
||||
mod ciphers;
|
||||
mod folders;
|
||||
mod two_factor;
|
||||
|
||||
use self::accounts::*;
|
||||
use self::ciphers::*;
|
||||
use self::folders::*;
|
||||
use self::two_factor::*;
|
||||
|
||||
pub fn routes() -> Vec<Route> {
|
||||
routes![
|
||||
register,
|
||||
profile,
|
||||
post_keys,
|
||||
post_password,
|
||||
post_sstamp,
|
||||
post_email,
|
||||
delete_account,
|
||||
revision_date,
|
||||
|
||||
sync,
|
||||
|
||||
get_ciphers,
|
||||
get_cipher,
|
||||
post_ciphers,
|
||||
post_ciphers_import,
|
||||
post_attachment,
|
||||
delete_attachment,
|
||||
post_cipher,
|
||||
put_cipher,
|
||||
delete_cipher,
|
||||
delete_all,
|
||||
|
||||
get_folders,
|
||||
get_folder,
|
||||
post_folders,
|
||||
post_folder,
|
||||
put_folder,
|
||||
delete_folder_post,
|
||||
delete_folder,
|
||||
|
||||
get_twofactor,
|
||||
get_recover,
|
||||
generate_authenticator,
|
||||
activate_authenticator,
|
||||
disable_authenticator,
|
||||
|
||||
get_collections,
|
||||
|
||||
clear_device_token,
|
||||
put_device_token,
|
||||
|
||||
get_eq_domains,
|
||||
post_eq_domains
|
||||
]
|
||||
}
|
||||
|
||||
///
|
||||
/// Move this somewhere else
|
||||
///
|
||||
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
|
||||
// GET /api/collections?writeOnly=false
|
||||
#[get("/collections")]
|
||||
fn get_collections() -> Result<Json, BadRequest<Json>> {
|
||||
Ok(Json(json!({
|
||||
"Data": [],
|
||||
"Object": "list"
|
||||
})))
|
||||
}
|
||||
|
||||
|
||||
#[put("/devices/identifier/<uuid>/clear-token")]
|
||||
fn clear_device_token(uuid: String) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
#[put("/devices/identifier/<uuid>/token")]
|
||||
fn put_device_token(uuid: String) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
|
||||
#[get("/settings/domains")]
|
||||
fn get_eq_domains() -> Result<Json, BadRequest<Json>> {
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/settings/domains")]
|
||||
fn post_eq_domains() -> Result<Json, BadRequest<Json>> {
|
||||
err!("Not implemented")
|
||||
}
|
||||
131
src/api/core/two_factor.rs
Normal file
131
src/api/core/two_factor.rs
Normal file
@ -0,0 +1,131 @@
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use data_encoding::BASE32;
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
|
||||
use util;
|
||||
use crypto;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
|
||||
#[get("/two-factor")]
|
||||
fn get_twofactor(headers: Headers) -> Result<Json, BadRequest<Json>> {
|
||||
let data = if headers.user.totp_secret.is_none() {
|
||||
Value::Null
|
||||
} else {
|
||||
json!([{
|
||||
"Enabled": true,
|
||||
"Type": 0,
|
||||
"Object": "twoFactorProvider"
|
||||
}])
|
||||
};
|
||||
|
||||
Ok(Json(json!({
|
||||
"Data": data,
|
||||
"Object": "list"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/get-recover", data = "<data>")]
|
||||
fn get_recover(data: Json<Value>, headers: Headers) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
|
||||
Ok(Json(json!({
|
||||
"Code": headers.user.totp_recover,
|
||||
"Object": "twoFactorRecover"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/get-authenticator", data = "<data>")]
|
||||
fn generate_authenticator(data: Json<Value>, headers: Headers) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
|
||||
let (enabled, key) = match headers.user.totp_secret {
|
||||
Some(secret) => (true, secret),
|
||||
_ => (false, BASE32.encode(&crypto::get_random(vec![0u8; 20])))
|
||||
};
|
||||
|
||||
Ok(Json(json!({
|
||||
"Enabled": enabled,
|
||||
"Key": key,
|
||||
"Object": "twoFactorAuthenticator"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/authenticator", data = "<data>")]
|
||||
fn activate_authenticator(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
let token = data["token"].as_str(); // 123456
|
||||
let key = data["key"].as_str().unwrap(); // YI4SKBIXG32LOA6VFKH2NI25VU3E4QML
|
||||
|
||||
// Validate key as base32 and 20 bytes length
|
||||
let decoded_key: Vec<u8> = match BASE32.decode(key.as_bytes()) {
|
||||
Ok(decoded) => decoded,
|
||||
_ => err!("Invalid totp secret")
|
||||
};
|
||||
|
||||
if decoded_key.len() != 20 {
|
||||
err!("Invalid key length")
|
||||
}
|
||||
|
||||
// Set key in user.totp_secret
|
||||
let mut user = headers.user;
|
||||
user.totp_secret = Some(key.to_uppercase());
|
||||
|
||||
// Validate the token provided with the key
|
||||
if !user.check_totp_code(util::parse_option_string(token)) {
|
||||
err!("Invalid totp code")
|
||||
}
|
||||
|
||||
// Generate totp_recover
|
||||
let totp_recover = BASE32.encode(&crypto::get_random(vec![0u8; 20]));
|
||||
user.totp_recover = Some(totp_recover);
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(json!({
|
||||
"Enabled": true,
|
||||
"Key": key,
|
||||
"Object": "twoFactorAuthenticator"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/disable", data = "<data>")]
|
||||
fn disable_authenticator(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let _type = &data["type"];
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
|
||||
let mut user = headers.user;
|
||||
user.totp_secret = None;
|
||||
user.totp_recover = None;
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(json!({
|
||||
"Enabled": false,
|
||||
"Type": 0,
|
||||
"Object": "twoFactorProvider"
|
||||
})))
|
||||
}
|
||||
Reference in New Issue
Block a user