v0.25.1

src/admin/session.rs

@@ -0,0 +1,406 @@
+async fn guard(State(state): State<Arc<App>>, mut request: Request, next: Next) -> Response {
+    let transport = request
+        .extensions()
+        .get::<Transport>()
+        .copied()
+        .unwrap_or_default();
+    let peer = request.extensions().get::<PeerAddr>().copied();
+    let raw_host = match admin_request_authority(&request, transport.tls) {
+        Ok(value) => value,
+        Err(()) => return secure(reject(StatusCode::FORBIDDEN, "auth.invalid_host")),
+    };
+    let headers = request.headers();
+    let scheme = match external_admin_scheme(&state, headers, peer, transport) {
+        Ok(value) => value,
+        Err(()) => return secure(reject(StatusCode::FORBIDDEN, "auth.invalid_origin")),
+    };
+    let external_authority =
+        match external_admin_authority(&state, headers, peer, &raw_host, scheme == "https") {
+            Ok(value) => value,
+            Err(()) => return secure(reject(StatusCode::FORBIDDEN, "auth.invalid_host")),
+        };
+    if headers.get_all(ORIGIN).iter().count() > 1
+        || headers.get(ORIGIN).is_some_and(|h| {
+            h.to_str()
+                .ok()
+                .is_none_or(|origin| !admin_origin_matches(origin, scheme, &external_authority))
+        })
+    {
+        return secure(reject(StatusCode::FORBIDDEN, "auth.invalid_origin"));
+    }
+    if headers
+        .get("sec-fetch-site")
+        .is_some_and(|h| h == "cross-site")
+    {
+        return secure(reject(StatusCode::FORBIDDEN, "auth.invalid_origin"));
+    }
+    let path = request.uri().path().to_owned();
+    let public = anonymous_allowed(request.method(), &path);
+    let unsafe_method = request.method() != Method::GET
+        && request.method() != Method::HEAD
+        && request.method() != Method::OPTIONS;
+    let secret = auth::cookie_secret(headers);
+    let certificate_api_session = if certificate_api_operation(request.method(), &path) {
+        match certificate_api_credentials(headers) {
+            Ok(None) => None,
+            Ok(Some((key_id, token))) => {
+                if peer.is_some_and(|peer| !peer.0.ip().is_loopback()) && scheme != "https" {
+                    return secure(reject(StatusCode::FORBIDDEN, "certificate_api.https_required"));
+                }
+                let token_hash = auth::secret_hash(&token);
+                match state
+                    .store
+                    .verify_certificate_api_credential(&key_id, &token_hash)
+                    .await
+                {
+                    Ok(true) => Some(Session {
+                        token_hash,
+                        csrf: String::new(),
+                        username: format!("certificate-api:{key_id}"),
+                        expires_at: auth::now().saturating_add(60),
+                        generation: 0,
+                    }),
+                    Ok(false) => {
+                        return secure(reject(
+                            StatusCode::UNAUTHORIZED,
+                            "certificate_api.invalid_token",
+                        ))
+                    }
+                    Err(error) => return secure(auth::internal(error).into_response()),
+                }
+            }
+            Err(()) => {
+                return secure(reject(
+                    StatusCode::UNAUTHORIZED,
+                    "certificate_api.invalid_token",
+                ))
+            }
+        }
+    } else {
+        None
+    };
+    let external_certificate_api = certificate_api_session.is_some();
+    let session_seconds = state
+        .config
+        .load()
+        .envelope
+        .config
+        .administration
+        .session_seconds();
+    // Panel document routes optionally authenticate so a direct refresh can choose
+    // the application shell when the browser still has a valid cookie. Public static
+    // login resources and capability discovery never load operational state.
+    let session = if certificate_api_session.is_some() {
+        certificate_api_session
+    } else if !public || panel_document_path(&path) {
+        match secret.as_deref() {
+            Some(secret) => match state
+                .store
+                .session_at_with_browser_lifetime(secret, auth::now(), session_seconds)
+                .await
+            {
+                Ok(value) => value,
+                Err(error) => return secure(auth::internal(error).into_response()),
+            },
+            None => None,
+        }
+    } else {
+        None
+    };
+    if !public && session.is_none() {
+        return secure(unauthorized(&request));
+    }
+    if unsafe_method && !external_certificate_api {
+        if single_header(headers, "origin")
+            .is_none_or(|origin| !admin_origin_matches(origin, scheme, &external_authority))
+            || single_header(headers, "x-rustproxy-request") != Some("1")
+        {
+            return secure(reject(StatusCode::FORBIDDEN, "auth.csrf"));
+        }
+        if !public
+            && !session.as_ref().is_some_and(|session| {
+                single_header(headers, "x-csrf-token")
+                    .is_some_and(|provided| auth::equal_secret(provided, &session.csrf))
+            })
+        {
+            return secure(reject(StatusCode::FORBIDDEN, "auth.csrf"));
+        }
+    }
+    if let Some(session) = session.clone() {
+        request.extensions_mut().insert(session);
+    }
+    let admin_origin = AdminOrigin {
+        secure: scheme == "https",
+    };
+    request.extensions_mut().insert(admin_origin);
+    request.extensions_mut().insert(transport);
+    let mut response = secure(next.run(request).await);
+    let refresh_session_cookie = !matches!(
+        path.as_str(),
+        "/api/auth/logout" | "/api/auth/logout-all" | "/api/auth/password"
+    );
+    if refresh_session_cookie {
+        if let (Some(secret), Some(session)) = (secret.as_deref(), session.as_ref()) {
+            let remaining = session.expires_at.saturating_sub(auth::now());
+            if remaining > 0 {
+                if let Ok(cookie) = HeaderValue::from_str(&auth::session_cookie(
+                    secret,
+                    admin_origin.secure,
+                    remaining,
+                )) {
+                    response.headers_mut().append(SET_COOKIE, cookie);
+                }
+            }
+        }
+    }
+    if matches!(path.as_str(), "/docs" | "/docs/") && response.status().is_success() {
+        // Swagger UI sets inline layout styles. This exception is limited to the
+        // authenticated documentation document; scripts remain self-only/no-eval.
+        response.headers_mut().insert("content-security-policy", HeaderValue::from_static(
+            "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"));
+    }
+    response
+}
+async fn auth_status(State(state): State<Arc<App>>) -> Result<Json<Value>, ApiError> {
+    // The one bit needed to render first-account setup; no version, paths, names,
+    // listeners, provider state, metrics or configuration before authentication.
+    Ok(Json(
+        json!({"setup_required":state.store.admin_record().await.map_err(auth::internal)?.is_none()}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Setup {
+    token: String,
+    username: String,
+    password: String,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Login {
+    username: String,
+    password: String,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PasswordChange {
+    current_password: String,
+    new_password: String,
+}
+async fn setup(
+    State(state): State<Arc<App>>,
+    input: Result<Json<Setup>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<Value>, ApiError> {
+    let Json(input) = input.map_err(public::invalid_json)?;
+    state
+        .auth
+        .setup(&input.token, &input.username, input.password)
+        .await?;
+    Ok(Json(json!({"initialized":true})))
+}
+fn session_payload(session: &Session, session_seconds: i64) -> Value {
+    json!({"username":session.username, "csrf_token":session.csrf, "expires_at":session.expires_at,
+        "idle_timeout_seconds":session_seconds, "session_lifetime_seconds":session_seconds})
+}
+async fn login(
+    State(state): State<Arc<App>>,
+    Extension(origin): Extension<AdminOrigin>,
+    headers: HeaderMap,
+    input: Result<Json<Login>, axum::extract::rejection::JsonRejection>,
+) -> Result<Response, ApiError> {
+    let Json(input) = input.map_err(public::invalid_json)?;
+    let previous = auth::cookie_secret(&headers);
+    let session_seconds = state
+        .config
+        .load()
+        .envelope
+        .config
+        .administration
+        .session_seconds();
+    let issued = state
+        .auth
+        .login(
+            &input.username,
+            input.password,
+            previous.as_deref(),
+            session_seconds,
+        )
+        .await?;
+    let mut response = Json(session_payload(&issued.session, session_seconds)).into_response();
+    response.headers_mut().insert(
+        SET_COOKIE,
+        auth::session_cookie(&issued.secret, origin.secure, session_seconds)
+            .parse()
+            .map_err(auth::internal)?,
+    );
+    Ok(response)
+}
+async fn session(
+    State(state): State<Arc<App>>,
+    Extension(session): Extension<Session>,
+) -> Json<Value> {
+    let session_seconds = state
+        .config
+        .load()
+        .envelope
+        .config
+        .administration
+        .session_seconds();
+    Json(session_payload(&session, session_seconds))
+}
+
+const LIVE_LOG_COLUMNS: &[&str] = &[
+    "time",
+    "request",
+    "host",
+    "source_ip",
+    "vhost",
+    "backend",
+    "status",
+    "duration",
+    "cache",
+    "outcome",
+    "transport",
+    "websocket",
+    "upstream_error",
+];
+
+fn default_admin_theme() -> String {
+    "dark".to_owned()
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct AdminPreferences {
+    live_log_columns: Vec<String>,
+    #[serde(default = "default_admin_theme")]
+    theme: String,
+}
+
+impl Default for AdminPreferences {
+    fn default() -> Self {
+        Self {
+            live_log_columns: LIVE_LOG_COLUMNS
+                .iter()
+                .map(|value| (*value).to_owned())
+                .collect(),
+            theme: default_admin_theme(),
+        }
+    }
+}
+
+fn validate_admin_preferences(preferences: &AdminPreferences) -> Result<(), ApiError> {
+    if preferences.live_log_columns.is_empty()
+        || preferences.live_log_columns.len() > LIVE_LOG_COLUMNS.len()
+    {
+        return Err(ApiError(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "at least one live-log column must be visible".into(),
+        ));
+    }
+    let mut seen = std::collections::HashSet::new();
+    for column in &preferences.live_log_columns {
+        if !LIVE_LOG_COLUMNS.contains(&column.as_str()) || !seen.insert(column.as_str()) {
+            return Err(ApiError(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "invalid live-log column preference".into(),
+            ));
+        }
+    }
+    if !matches!(preferences.theme.as_str(), "dark" | "light") {
+        return Err(ApiError(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid administration theme preference".into(),
+        ));
+    }
+    Ok(())
+}
+
+async fn preferences(
+    State(state): State<Arc<App>>,
+    Extension(session): Extension<Session>,
+) -> Result<Json<AdminPreferences>, ApiError> {
+    let stored = state
+        .store
+        .admin_preferences(&session.username)
+        .await
+        .map_err(auth::internal)?;
+    let preferences = match stored {
+        Some(document) => match serde_json::from_str::<AdminPreferences>(&document) {
+            Ok(preferences) if validate_admin_preferences(&preferences).is_ok() => preferences,
+            Ok(_) | Err(_) => {
+                tracing::warn!(user = %session.username, "invalid admin view preferences ignored");
+                AdminPreferences::default()
+            }
+        },
+        None => AdminPreferences::default(),
+    };
+    Ok(Json(preferences))
+}
+
+async fn update_preferences(
+    State(state): State<Arc<App>>,
+    Extension(session): Extension<Session>,
+    input: Result<Json<AdminPreferences>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<AdminPreferences>, ApiError> {
+    let Json(preferences) = input.map_err(public::invalid_json)?;
+    validate_admin_preferences(&preferences)?;
+    let document = serde_json::to_string(&preferences).map_err(auth::internal)?;
+    if !state
+        .store
+        .save_admin_preferences(&session.username, &document)
+        .await
+        .map_err(auth::internal)?
+    {
+        return Err(ApiError(
+            StatusCode::UNAUTHORIZED,
+            "auth.invalid_credentials".into(),
+        ));
+    }
+    Ok(Json(preferences))
+}
+fn logged_out(secure_cookie: bool) -> Response {
+    let mut response = Json(json!({"logged_out":true})).into_response();
+    response.headers_mut().insert(
+        SET_COOKIE,
+        HeaderValue::from_str(&auth::expired_cookie(secure_cookie))
+            .expect("static cookie attributes"),
+    );
+    response
+}
+async fn logout(
+    State(state): State<Arc<App>>,
+    Extension(origin): Extension<AdminOrigin>,
+    Extension(session): Extension<Session>,
+) -> Result<Response, ApiError> {
+    state
+        .store
+        .end_session(&session)
+        .await
+        .map_err(auth::internal)?;
+    Ok(logged_out(origin.secure))
+}
+async fn logout_all(
+    State(state): State<Arc<App>>,
+    Extension(origin): Extension<AdminOrigin>,
+    Extension(session): Extension<Session>,
+) -> Result<Response, ApiError> {
+    state
+        .store
+        .revoke_all_sessions(&session.username)
+        .await
+        .map_err(auth::internal)?;
+    Ok(logged_out(origin.secure))
+}
+async fn password(
+    State(state): State<Arc<App>>,
+    Extension(origin): Extension<AdminOrigin>,
+    Extension(session): Extension<Session>,
+    Json(input): Json<PasswordChange>,
+) -> Result<Response, ApiError> {
+    state
+        .auth
+        .change_password(&session, input.current_password, input.new_password)
+        .await?;
+    Ok(logged_out(origin.secure))
+}