mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-09-11 03:05:58 +03:00
First working version
This commit is contained in:
Daniel García
149
src/api/core/accounts.rs
Normal file
149
src/api/core/accounts.rs
Normal file
@@ -0,0 +1,149 @@
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
use CONFIG;
|
||||
|
||||
#[derive(Deserialize, Debug)]
|
||||
#[allow(non_snake_case)]
|
||||
struct RegisterData {
|
||||
email: String,
|
||||
key: String,
|
||||
keys: Option<KeysData>,
|
||||
masterPasswordHash: String,
|
||||
masterPasswordHint: Option<String>,
|
||||
name: Option<String>,
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Debug)]
|
||||
#[allow(non_snake_case)]
|
||||
struct KeysData {
|
||||
encryptedPrivateKey: String,
|
||||
publicKey: String,
|
||||
}
|
||||
|
||||
#[post("/accounts/register", data = "<data>")]
|
||||
fn register(data: Json<RegisterData>, conn: DbConn) -> Result<(), BadRequest<Json>> {
|
||||
if CONFIG.signups_allowed {
|
||||
err!(format!("Signups not allowed"))
|
||||
}
|
||||
println!("DEBUG - {:#?}", data);
|
||||
|
||||
if let Some(_) = User::find_by_mail(&data.email, &conn) {
|
||||
err!("Email already exists")
|
||||
}
|
||||
|
||||
let mut user = User::new(data.email.clone(),
|
||||
data.key.clone(),
|
||||
data.masterPasswordHash.clone());
|
||||
|
||||
// Add extra fields if present
|
||||
if let Some(name) = data.name.clone() {
|
||||
user.name = name;
|
||||
}
|
||||
|
||||
if let Some(hint) = data.masterPasswordHint.clone() {
|
||||
user.password_hint = Some(hint);
|
||||
}
|
||||
|
||||
if let Some(ref keys) = data.keys {
|
||||
user.private_key = Some(keys.encryptedPrivateKey.clone());
|
||||
user.public_key = Some(keys.publicKey.clone());
|
||||
}
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[get("/accounts/profile")]
|
||||
fn profile(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
Ok(Json(headers.user.to_json()))
|
||||
}
|
||||
|
||||
#[post("/accounts/keys", data = "<data>")]
|
||||
fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut user = headers.user;
|
||||
|
||||
user.private_key = Some(data.encryptedPrivateKey.clone());
|
||||
user.public_key = Some(data.publicKey.clone());
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(user.to_json()))
|
||||
}
|
||||
|
||||
#[post("/accounts/password", data = "<data>")]
|
||||
fn post_password(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let key = data["key"].as_str().unwrap();
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
let new_password_hash = data["newMasterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
user.set_password(new_password_hash);
|
||||
user.key = key.to_string();
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(json!({})))
|
||||
}
|
||||
|
||||
#[post("/accounts/security-stamp", data = "<data>")]
|
||||
fn post_sstamp(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
user.reset_security_stamp();
|
||||
|
||||
Ok(Json(json!({})))
|
||||
}
|
||||
|
||||
#[post("/accounts/email-token", data = "<data>")]
|
||||
fn post_email(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
println!("{:#?}", data);
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/accounts/delete", data = "<data>")]
|
||||
fn delete_account(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[get("/accounts/revision-date")]
|
||||
fn revision_date(headers: Headers, conn: DbConn) -> Result<String, BadRequest<Json>> {
|
||||
let revision_date = headers.user.updated_at.timestamp();
|
||||
Ok(revision_date.to_string())
|
||||
}
|
||||
251
src/api/core/ciphers.rs
Normal file
251
src/api/core/ciphers.rs
Normal file
@@ -0,0 +1,251 @@
|
||||
use std::io::{Cursor, Read};
|
||||
|
||||
use rocket::{Route, Data};
|
||||
use rocket::http::ContentType;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use multipart::server::Multipart;
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
#[get("/sync")]
|
||||
fn sync(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let user = headers.user;
|
||||
|
||||
let folders = Folder::find_by_user(&user.uuid, &conn);
|
||||
let folders_json: Vec<Value> = folders.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
let ciphers = Cipher::find_by_user(&user.uuid, &conn);
|
||||
let ciphers_json: Vec<Value> = ciphers.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
Ok(Json(json!({
|
||||
"Profile": user.to_json(),
|
||||
"Folders": folders_json,
|
||||
"Ciphers": ciphers_json,
|
||||
"Domains": {
|
||||
"EquivalentDomains": [],
|
||||
"GlobalEquivalentDomains": [],
|
||||
"Object": "domains",
|
||||
},
|
||||
"Object": "sync"
|
||||
})))
|
||||
}
|
||||
|
||||
|
||||
#[get("/ciphers")]
|
||||
fn get_ciphers(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let ciphers = Cipher::find_by_user(&headers.user.uuid, &conn);
|
||||
|
||||
let ciphers_json: Vec<Value> = ciphers.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
Ok(Json(json!({
|
||||
"Data": ciphers_json,
|
||||
"Object": "list",
|
||||
})))
|
||||
}
|
||||
|
||||
#[get("/ciphers/<uuid>")]
|
||||
fn get_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let cipher = match Cipher::find_by_uuid(&uuid, &conn) {
|
||||
Some(cipher) => cipher,
|
||||
None => err!("Cipher doesn't exist")
|
||||
};
|
||||
|
||||
if cipher.user_uuid != headers.user.uuid {
|
||||
err!("Cipher is now owned by user")
|
||||
}
|
||||
|
||||
Ok(Json(cipher.to_json()))
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Debug)]
|
||||
#[allow(non_snake_case)]
|
||||
struct CipherData {
|
||||
#[serde(rename = "type")]
|
||||
type_: i32,
|
||||
folderId: Option<String>,
|
||||
organizationId: Option<String>,
|
||||
name: Option<String>,
|
||||
notes: Option<String>,
|
||||
favorite: Option<bool>,
|
||||
login: Option<Value>,
|
||||
card: Option<Value>,
|
||||
fields: Option<Vec<Value>>,
|
||||
}
|
||||
|
||||
#[post("/ciphers", data = "<data>")]
|
||||
fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut cipher = Cipher::new(headers.user.uuid.clone(),
|
||||
data.type_,
|
||||
data.favorite.unwrap_or(false));
|
||||
|
||||
if let Some(ref folder_id) = data.folderId {
|
||||
// TODO: Validate folder is owned by user
|
||||
cipher.folder_uuid = Some(folder_id.clone());
|
||||
}
|
||||
|
||||
if let Some(ref org_id) = data.organizationId {
|
||||
cipher.organization_uuid = Some(org_id.clone());
|
||||
}
|
||||
|
||||
cipher.data = match value_from_data(&data) {
|
||||
Ok(value) => {
|
||||
use serde_json;
|
||||
println!("--- {:?}", serde_json::to_string(&value));
|
||||
println!("--- {:?}", value.to_string());
|
||||
|
||||
value.to_string()
|
||||
}
|
||||
Err(msg) => err!(msg)
|
||||
};
|
||||
|
||||
cipher.save(&conn);
|
||||
|
||||
Ok(Json(cipher.to_json()))
|
||||
}
|
||||
|
||||
fn value_from_data(data: &CipherData) -> Result<Value, &'static str> {
|
||||
let mut values = json!({
|
||||
"Name": data.name,
|
||||
"Notes": data.notes
|
||||
});
|
||||
|
||||
match data.type_ {
|
||||
1 /*Login*/ => {
|
||||
let login_data = match data.login {
|
||||
Some(ref login) => login.clone(),
|
||||
None => return Err("Login data missing")
|
||||
};
|
||||
|
||||
if !copy_values(&login_data, &mut values) {
|
||||
return Err("Login data invalid");
|
||||
}
|
||||
}
|
||||
3 /*Card*/ => {
|
||||
let card_data = match data.card {
|
||||
Some(ref card) => card.clone(),
|
||||
None => return Err("Card data missing")
|
||||
};
|
||||
|
||||
if !copy_values(&card_data, &mut values) {
|
||||
return Err("Card data invalid");
|
||||
}
|
||||
}
|
||||
_ => return Err("Unknown type")
|
||||
}
|
||||
|
||||
if let Some(ref fields) = data.fields {
|
||||
values["Fields"] = Value::Array(fields.iter().map(|f| {
|
||||
use std::collections::BTreeMap;
|
||||
use serde_json;
|
||||
|
||||
let empty_map: BTreeMap<String, Value> = BTreeMap::new();
|
||||
let mut value = serde_json::to_value(empty_map).unwrap();
|
||||
|
||||
copy_values(&f, &mut value);
|
||||
|
||||
value
|
||||
}).collect());
|
||||
} else {
|
||||
values["Fields"] = Value::Null;
|
||||
}
|
||||
|
||||
Ok(values)
|
||||
}
|
||||
|
||||
fn copy_values(from: &Value, to: &mut Value) -> bool {
|
||||
let map = match from.as_object() {
|
||||
Some(map) => map,
|
||||
None => return false
|
||||
};
|
||||
|
||||
for (key, val) in map {
|
||||
to[util::upcase_first(key)] = val.clone();
|
||||
}
|
||||
|
||||
true
|
||||
}
|
||||
|
||||
#[post("/ciphers/import", data = "<data>")]
|
||||
fn post_ciphers_import(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
println!("{:#?}", data);
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/ciphers/<uuid>/attachment", format = "multipart/form-data", data = "<data>")]
|
||||
fn post_attachment(uuid: String, data: Data, content_type: &ContentType, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
// TODO: Check if cipher exists
|
||||
|
||||
let mut params = content_type.params();
|
||||
let boundary_pair = params.next().expect("No boundary provided"); // ("boundary", "----WebKitFormBoundary...")
|
||||
let boundary = boundary_pair.1;
|
||||
|
||||
use data_encoding::BASE64URL;
|
||||
use crypto;
|
||||
use CONFIG;
|
||||
|
||||
// TODO: Maybe use the same format as the official server?
|
||||
let attachment_id = BASE64URL.encode(&crypto::get_random_64());
|
||||
let path = format!("{}/{}/{}", CONFIG.attachments_folder,
|
||||
headers.user.uuid, attachment_id);
|
||||
println!("Path {:#?}", path);
|
||||
|
||||
let mut mp = Multipart::with_body(data.open(), boundary);
|
||||
match mp.save().with_dir(path).into_entries() {
|
||||
Some(entries) => {
|
||||
println!("Entries {:#?}", entries);
|
||||
|
||||
let saved_file = &entries.files["data"][0]; // Only one file at a time
|
||||
let file_name = &saved_file.filename; // This is provided by the client, don't trust it
|
||||
let file_size = &saved_file.size;
|
||||
}
|
||||
None => err!("No data entries")
|
||||
}
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[delete("/ciphers/<uuid>/attachment/<attachment_id>")]
|
||||
fn delete_attachment(uuid: String, attachment_id: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
if uuid != headers.user.uuid {
|
||||
err!("Permission denied")
|
||||
}
|
||||
|
||||
// Delete file
|
||||
|
||||
// Delete entry in cipher
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/ciphers/<uuid>")]
|
||||
fn post_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
put_cipher(uuid, headers, conn)
|
||||
}
|
||||
|
||||
#[put("/ciphers/<uuid>")]
|
||||
fn put_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
#[delete("/ciphers/<uuid>")]
|
||||
fn delete_cipher(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
#[post("/ciphers/delete", data = "<data>")]
|
||||
fn delete_all(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
let user = headers.user;
|
||||
|
||||
if !user.check_valid_password(password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
// Cipher::delete_from_user(&conn);
|
||||
|
||||
err!("Not implemented")
|
||||
}
|
||||
102
src/api/core/folders.rs
Normal file
102
src/api/core/folders.rs
Normal file
@@ -0,0 +1,102 @@
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
#[get("/folders")]
|
||||
fn get_folders(headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let folders = Folder::find_by_user(&headers.user.uuid, &conn);
|
||||
|
||||
let folders_json: Vec<Value> = folders.iter().map(|c| c.to_json()).collect();
|
||||
|
||||
Ok(Json(json!({
|
||||
"Data": folders_json,
|
||||
"Object": "list",
|
||||
})))
|
||||
}
|
||||
|
||||
#[get("/folders/<uuid>")]
|
||||
fn get_folder(uuid: String, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut folder = match Folder::find_by_uuid(&uuid, &conn) {
|
||||
Some(folder) => folder,
|
||||
_ => err!("Invalid folder")
|
||||
};
|
||||
|
||||
if folder.user_uuid != headers.user.uuid {
|
||||
err!("Folder belongs to another user")
|
||||
}
|
||||
|
||||
Ok(Json(folder.to_json()))
|
||||
}
|
||||
|
||||
#[post("/folders", data = "<data>")]
|
||||
fn post_folders(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let name = &data["name"].as_str();
|
||||
|
||||
if name.is_none() {
|
||||
err!("Invalid name")
|
||||
}
|
||||
|
||||
let folder = Folder::new(headers.user.uuid.clone(), name.unwrap().into());
|
||||
|
||||
folder.save(&conn);
|
||||
|
||||
Ok(Json(folder.to_json()))
|
||||
}
|
||||
|
||||
#[post("/folders/<uuid>", data = "<data>")]
|
||||
fn post_folder(uuid: String, data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
put_folder(uuid, data, headers, conn)
|
||||
}
|
||||
|
||||
#[put("/folders/<uuid>", data = "<data>")]
|
||||
fn put_folder(uuid: String, data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let mut folder = match Folder::find_by_uuid(&uuid, &conn) {
|
||||
Some(folder) => folder,
|
||||
_ => err!("Invalid folder")
|
||||
};
|
||||
|
||||
if folder.user_uuid != headers.user.uuid {
|
||||
err!("Folder belongs to another user")
|
||||
}
|
||||
|
||||
let name = &data["name"].as_str();
|
||||
|
||||
if name.is_none() {
|
||||
err!("Invalid name")
|
||||
}
|
||||
|
||||
folder.name = name.unwrap().into();
|
||||
|
||||
folder.save(&conn);
|
||||
|
||||
Ok(Json(folder.to_json()))
|
||||
}
|
||||
|
||||
#[post("/folders/<uuid>/delete", data = "<data>")]
|
||||
fn delete_folder_post(uuid: String, data: Json<Value>, headers: Headers, conn: DbConn) -> Result<(), BadRequest<Json>> {
|
||||
// Data contains a json object with the id, but we don't need it
|
||||
delete_folder(uuid, headers, conn)
|
||||
}
|
||||
|
||||
#[delete("/folders/<uuid>")]
|
||||
fn delete_folder(uuid: String, headers: Headers, conn: DbConn) -> Result<(), BadRequest<Json>> {
|
||||
let folder = match Folder::find_by_uuid(&uuid, &conn) {
|
||||
Some(folder) => folder,
|
||||
_ => err!("Invalid folder")
|
||||
};
|
||||
|
||||
if folder.user_uuid != headers.user.uuid {
|
||||
err!("Folder belongs to another user")
|
||||
}
|
||||
|
||||
folder.delete(&conn);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
100
src/api/core/mod.rs
Normal file
100
src/api/core/mod.rs
Normal file
@@ -0,0 +1,100 @@
|
||||
mod accounts;
|
||||
mod ciphers;
|
||||
mod folders;
|
||||
mod two_factor;
|
||||
|
||||
use self::accounts::*;
|
||||
use self::ciphers::*;
|
||||
use self::folders::*;
|
||||
use self::two_factor::*;
|
||||
|
||||
pub fn routes() -> Vec<Route> {
|
||||
routes![
|
||||
register,
|
||||
profile,
|
||||
post_keys,
|
||||
post_password,
|
||||
post_sstamp,
|
||||
post_email,
|
||||
delete_account,
|
||||
revision_date,
|
||||
|
||||
sync,
|
||||
|
||||
get_ciphers,
|
||||
get_cipher,
|
||||
post_ciphers,
|
||||
post_ciphers_import,
|
||||
post_attachment,
|
||||
delete_attachment,
|
||||
post_cipher,
|
||||
put_cipher,
|
||||
delete_cipher,
|
||||
delete_all,
|
||||
|
||||
get_folders,
|
||||
get_folder,
|
||||
post_folders,
|
||||
post_folder,
|
||||
put_folder,
|
||||
delete_folder_post,
|
||||
delete_folder,
|
||||
|
||||
get_twofactor,
|
||||
get_recover,
|
||||
generate_authenticator,
|
||||
activate_authenticator,
|
||||
disable_authenticator,
|
||||
|
||||
get_collections,
|
||||
|
||||
clear_device_token,
|
||||
put_device_token,
|
||||
|
||||
get_eq_domains,
|
||||
post_eq_domains
|
||||
]
|
||||
}
|
||||
|
||||
///
|
||||
/// Move this somewhere else
|
||||
///
|
||||
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
|
||||
// GET /api/collections?writeOnly=false
|
||||
#[get("/collections")]
|
||||
fn get_collections() -> Result<Json, BadRequest<Json>> {
|
||||
Ok(Json(json!({
|
||||
"Data": [],
|
||||
"Object": "list"
|
||||
})))
|
||||
}
|
||||
|
||||
|
||||
#[put("/devices/identifier/<uuid>/clear-token")]
|
||||
fn clear_device_token(uuid: String) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
#[put("/devices/identifier/<uuid>/token")]
|
||||
fn put_device_token(uuid: String) -> Result<Json, BadRequest<Json>> { err!("Not implemented") }
|
||||
|
||||
|
||||
#[get("/settings/domains")]
|
||||
fn get_eq_domains() -> Result<Json, BadRequest<Json>> {
|
||||
err!("Not implemented")
|
||||
}
|
||||
|
||||
#[post("/settings/domains")]
|
||||
fn post_eq_domains() -> Result<Json, BadRequest<Json>> {
|
||||
err!("Not implemented")
|
||||
}
|
||||
131
src/api/core/two_factor.rs
Normal file
131
src/api/core/two_factor.rs
Normal file
@@ -0,0 +1,131 @@
|
||||
use rocket::Route;
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use data_encoding::BASE32;
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
|
||||
use util;
|
||||
use crypto;
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
|
||||
#[get("/two-factor")]
|
||||
fn get_twofactor(headers: Headers) -> Result<Json, BadRequest<Json>> {
|
||||
let data = if headers.user.totp_secret.is_none() {
|
||||
Value::Null
|
||||
} else {
|
||||
json!([{
|
||||
"Enabled": true,
|
||||
"Type": 0,
|
||||
"Object": "twoFactorProvider"
|
||||
}])
|
||||
};
|
||||
|
||||
Ok(Json(json!({
|
||||
"Data": data,
|
||||
"Object": "list"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/get-recover", data = "<data>")]
|
||||
fn get_recover(data: Json<Value>, headers: Headers) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
|
||||
Ok(Json(json!({
|
||||
"Code": headers.user.totp_recover,
|
||||
"Object": "twoFactorRecover"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/get-authenticator", data = "<data>")]
|
||||
fn generate_authenticator(data: Json<Value>, headers: Headers) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
|
||||
let (enabled, key) = match headers.user.totp_secret {
|
||||
Some(secret) => (true, secret),
|
||||
_ => (false, BASE32.encode(&crypto::get_random(vec![0u8; 20])))
|
||||
};
|
||||
|
||||
Ok(Json(json!({
|
||||
"Enabled": enabled,
|
||||
"Key": key,
|
||||
"Object": "twoFactorAuthenticator"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/authenticator", data = "<data>")]
|
||||
fn activate_authenticator(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
let token = data["token"].as_str(); // 123456
|
||||
let key = data["key"].as_str().unwrap(); // YI4SKBIXG32LOA6VFKH2NI25VU3E4QML
|
||||
|
||||
// Validate key as base32 and 20 bytes length
|
||||
let decoded_key: Vec<u8> = match BASE32.decode(key.as_bytes()) {
|
||||
Ok(decoded) => decoded,
|
||||
_ => err!("Invalid totp secret")
|
||||
};
|
||||
|
||||
if decoded_key.len() != 20 {
|
||||
err!("Invalid key length")
|
||||
}
|
||||
|
||||
// Set key in user.totp_secret
|
||||
let mut user = headers.user;
|
||||
user.totp_secret = Some(key.to_uppercase());
|
||||
|
||||
// Validate the token provided with the key
|
||||
if !user.check_totp_code(util::parse_option_string(token)) {
|
||||
err!("Invalid totp code")
|
||||
}
|
||||
|
||||
// Generate totp_recover
|
||||
let totp_recover = BASE32.encode(&crypto::get_random(vec![0u8; 20]));
|
||||
user.totp_recover = Some(totp_recover);
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(json!({
|
||||
"Enabled": true,
|
||||
"Key": key,
|
||||
"Object": "twoFactorAuthenticator"
|
||||
})))
|
||||
}
|
||||
|
||||
#[post("/two-factor/disable", data = "<data>")]
|
||||
fn disable_authenticator(data: Json<Value>, headers: Headers, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let _type = &data["type"];
|
||||
let password_hash = data["masterPasswordHash"].as_str().unwrap();
|
||||
|
||||
if !headers.user.check_valid_password(password_hash) {
|
||||
err!("Invalid password");
|
||||
}
|
||||
|
||||
let mut user = headers.user;
|
||||
user.totp_secret = None;
|
||||
user.totp_recover = None;
|
||||
|
||||
user.save(&conn);
|
||||
|
||||
Ok(Json(json!({
|
||||
"Enabled": false,
|
||||
"Type": 0,
|
||||
"Object": "twoFactorProvider"
|
||||
})))
|
||||
}
|
||||
85
src/api/icons.rs
Normal file
85
src/api/icons.rs
Normal file
@@ -0,0 +1,85 @@
|
||||
use std::io;
|
||||
use std::io::prelude::*;
|
||||
use std::fs::{create_dir_all, File};
|
||||
use std::path::Path;
|
||||
|
||||
use rocket::Route;
|
||||
use rocket::response::Content;
|
||||
use rocket::http::ContentType;
|
||||
|
||||
use reqwest;
|
||||
|
||||
use CONFIG;
|
||||
|
||||
pub fn routes() -> Vec<Route> {
|
||||
routes![icon]
|
||||
}
|
||||
|
||||
#[get("/<domain>/icon.png")]
|
||||
fn icon(domain: String) -> Content<Vec<u8>> {
|
||||
// Validate the domain to avoid directory traversal attacks
|
||||
if domain.contains("/") || domain.contains("..") {
|
||||
return Content(ContentType::PNG, get_fallback_icon());
|
||||
}
|
||||
|
||||
let url = format!("https://icons.bitwarden.com/{}/icon.png", domain);
|
||||
|
||||
// Get the icon, or fallback in case of error
|
||||
let icon = match get_icon_cached(&domain, &url) {
|
||||
Ok(icon) => icon,
|
||||
Err(e) => return Content(ContentType::PNG, get_fallback_icon())
|
||||
};
|
||||
|
||||
Content(ContentType::PNG, icon)
|
||||
}
|
||||
|
||||
fn get_icon(url: &str) -> Result<Vec<u8>, reqwest::Error> {
|
||||
let mut res = reqwest::get(url)?;
|
||||
|
||||
res = match res.error_for_status() {
|
||||
Err(e) => return Err(e),
|
||||
Ok(res) => res
|
||||
};
|
||||
|
||||
let mut buffer: Vec<u8> = vec![];
|
||||
res.copy_to(&mut buffer)?;
|
||||
|
||||
Ok(buffer)
|
||||
}
|
||||
|
||||
fn get_icon_cached(key: &str, url: &str) -> io::Result<Vec<u8>> {
|
||||
create_dir_all(&CONFIG.icon_cache_folder)?;
|
||||
let path = &format!("{}/{}.png", CONFIG.icon_cache_folder, key);
|
||||
|
||||
/// Try to read the cached icon, and return it if it exists
|
||||
match File::open(path) {
|
||||
Ok(mut f) => {
|
||||
let mut buffer = Vec::new();
|
||||
|
||||
if f.read_to_end(&mut buffer).is_ok() {
|
||||
return Ok(buffer);
|
||||
}
|
||||
/* If error reading file continue */
|
||||
}
|
||||
Err(_) => { /* Continue */ }
|
||||
}
|
||||
|
||||
println!("Downloading icon for {}...", key);
|
||||
let icon = match get_icon(url) {
|
||||
Ok(icon) => icon,
|
||||
Err(_) => return Err(io::Error::new(io::ErrorKind::NotFound, ""))
|
||||
};
|
||||
|
||||
/// Save the currently downloaded icon
|
||||
match File::create(path) {
|
||||
Ok(mut f) => { f.write_all(&icon); }
|
||||
Err(_) => { /* Continue */ }
|
||||
};
|
||||
|
||||
Ok(icon)
|
||||
}
|
||||
|
||||
fn get_fallback_icon() -> Vec<u8> {
|
||||
let fallback_icon = "https://raw.githubusercontent.com/bitwarden/web/master/src/images/fa-globe.png";
|
||||
get_icon_cached("default", fallback_icon).unwrap()
|
||||
}
|
||||
225
src/api/identity.rs
Normal file
225
src/api/identity.rs
Normal file
@@ -0,0 +1,225 @@
|
||||
use std::collections::HashMap;
|
||||
|
||||
use rocket::Route;
|
||||
use rocket::request::{Form, FormItems, FromForm};
|
||||
use rocket::response::status::BadRequest;
|
||||
|
||||
use rocket_contrib::Json;
|
||||
|
||||
use db::DbConn;
|
||||
use db::models::*;
|
||||
use util;
|
||||
|
||||
pub fn routes() -> Vec<Route> {
|
||||
routes![ login]
|
||||
}
|
||||
|
||||
#[post("/connect/token", data = "<connect_data>")]
|
||||
fn login(connect_data: Form<ConnectData>, conn: DbConn) -> Result<Json, BadRequest<Json>> {
|
||||
let data = connect_data.get();
|
||||
println!("{:#?}", data);
|
||||
|
||||
let mut device = match data.grant_type {
|
||||
GrantType::RefreshToken => {
|
||||
// Extract token
|
||||
let token = data.get("refresh_token").unwrap();
|
||||
|
||||
// Get device by refresh token
|
||||
match Device::find_by_refresh_token(token, &conn) {
|
||||
Some(device) => device,
|
||||
None => err!("Invalid refresh token")
|
||||
}
|
||||
}
|
||||
GrantType::Password => {
|
||||
// Validate scope
|
||||
let scope = data.get("scope").unwrap();
|
||||
if scope != "api offline_access" {
|
||||
err!("Scope not supported")
|
||||
}
|
||||
|
||||
// Get the user
|
||||
let username = data.get("username").unwrap();
|
||||
let user = match User::find_by_mail(username, &conn) {
|
||||
Some(user) => user,
|
||||
None => err!("Invalid username or password")
|
||||
};
|
||||
|
||||
// Check password
|
||||
let password = data.get("password").unwrap();
|
||||
if !user.check_valid_password(password) {
|
||||
err!("Invalid username or password")
|
||||
}
|
||||
|
||||
/*
|
||||
//TODO: When invalid username or password, return this with a 400 BadRequest:
|
||||
{
|
||||
"error": "invalid_grant",
|
||||
"error_description": "invalid_username_or_password",
|
||||
"ErrorModel": {
|
||||
"Message": "Username or password is incorrect. Try again.",
|
||||
"ValidationErrors": null,
|
||||
"ExceptionMessage": null,
|
||||
"ExceptionStackTrace": null,
|
||||
"InnerExceptionMessage": null,
|
||||
"Object": "error"
|
||||
}
|
||||
}
|
||||
*/
|
||||
|
||||
// Check if totp code is required and the value is correct
|
||||
let totp_code = util::parse_option_string(data.get("twoFactorToken").map(String::as_ref));
|
||||
|
||||
if !user.check_totp_code(totp_code) {
|
||||
// Return error 400
|
||||
return err_json!(json!({
|
||||
"error" : "invalid_grant",
|
||||
"error_description" : "Two factor required.",
|
||||
"TwoFactorProviders" : [ 0 ],
|
||||
"TwoFactorProviders2" : { "0" : null }
|
||||
}));
|
||||
}
|
||||
|
||||
// Let's only use the header and ignore the 'devicetype' parameter
|
||||
// TODO Get header Device-Type
|
||||
let device_type_num = 0;// headers.device_type;
|
||||
|
||||
let (device_id, device_name) = match data.get("client_id").unwrap().as_ref() {
|
||||
"web" => { (format!("web-{}", user.uuid), String::from("web")) }
|
||||
"browser" | "mobile" => {
|
||||
(
|
||||
data.get("deviceidentifier").unwrap().clone(),
|
||||
data.get("devicename").unwrap().clone(),
|
||||
)
|
||||
}
|
||||
_ => err!("Invalid client id")
|
||||
};
|
||||
|
||||
// Find device or create new
|
||||
let device = match Device::find_by_uuid(&device_id, &conn) {
|
||||
Some(device) => {
|
||||
// Check if valid device
|
||||
if device.user_uuid != user.uuid {
|
||||
device.delete(&conn);
|
||||
err!("Device is not owned by user")
|
||||
}
|
||||
|
||||
device
|
||||
}
|
||||
None => {
|
||||
// Create new device
|
||||
Device::new(device_id, user.uuid, device_name, device_type_num)
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
device
|
||||
}
|
||||
};
|
||||
|
||||
let user = User::find_by_uuid(&device.user_uuid, &conn).unwrap();
|
||||
let (access_token, expires_in) = device.refresh_tokens(&user);
|
||||
device.save(&conn);
|
||||
|
||||
// TODO: when to include :privateKey and :TwoFactorToken?
|
||||
Ok(Json(json!({
|
||||
"access_token": access_token,
|
||||
"expires_in": expires_in,
|
||||
"token_type": "Bearer",
|
||||
"refresh_token": device.refresh_token,
|
||||
"Key": user.key,
|
||||
"PrivateKey": user.private_key
|
||||
})))
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
struct ConnectData {
|
||||
grant_type: GrantType,
|
||||
data: HashMap<String, String>,
|
||||
}
|
||||
|
||||
impl ConnectData {
|
||||
fn get(&self, key: &str) -> Option<&String> {
|
||||
self.data.get(&key.to_lowercase())
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Copy, Clone)]
|
||||
enum GrantType { RefreshToken, Password }
|
||||
|
||||
|
||||
const VALUES_REFRESH: [&str; 1] = ["refresh_token"];
|
||||
|
||||
const VALUES_PASSWORD: [&str; 5] = ["client_id",
|
||||
"grant_type", "password", "scope", "username"];
|
||||
|
||||
const VALUES_DEVICE: [&str; 3] = ["deviceidentifier",
|
||||
"devicename", "devicetype"];
|
||||
|
||||
|
||||
impl<'f> FromForm<'f> for ConnectData {
|
||||
type Error = String;
|
||||
|
||||
fn from_form(items: &mut FormItems<'f>, strict: bool) -> Result<Self, Self::Error> {
|
||||
let mut data = HashMap::new();
|
||||
|
||||
// Insert data into map
|
||||
for (key, value) in items {
|
||||
let decoded_key: String = match key.url_decode() {
|
||||
Ok(decoded) => decoded,
|
||||
Err(e) => return Err(format!("Error decoding key: {}", value)),
|
||||
};
|
||||
|
||||
let decoded_value: String = match value.url_decode() {
|
||||
Ok(decoded) => decoded,
|
||||
Err(e) => return Err(format!("Error decoding value: {}", value)),
|
||||
};
|
||||
|
||||
data.insert(decoded_key.to_lowercase(), decoded_value);
|
||||
}
|
||||
|
||||
// Validate needed values
|
||||
let grant_type =
|
||||
match data.get("grant_type").map(|s| &s[..]) {
|
||||
Some("refresh_token") => {
|
||||
// Check if refresh token is proviced
|
||||
if let Err(msg) = check_values(&data, &VALUES_REFRESH) {
|
||||
return Err(msg);
|
||||
}
|
||||
|
||||
GrantType::RefreshToken
|
||||
}
|
||||
Some("password") => {
|
||||
// Check if basic values are provided
|
||||
if let Err(msg) = check_values(&data, &VALUES_PASSWORD) {
|
||||
return Err(msg);
|
||||
}
|
||||
|
||||
// Check that device values are present on device
|
||||
match data.get("client_id").unwrap().as_ref() {
|
||||
"browser" | "mobile" => {
|
||||
if let Err(msg) = check_values(&data, &VALUES_DEVICE) {
|
||||
return Err(msg);
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
|
||||
GrantType::Password
|
||||
}
|
||||
|
||||
_ => return Err(format!("Grant type not supported"))
|
||||
};
|
||||
|
||||
Ok(ConnectData { grant_type, data })
|
||||
}
|
||||
}
|
||||
|
||||
fn check_values(map: &HashMap<String, String>, values: &[&str]) -> Result<(), String> {
|
||||
for value in values {
|
||||
if !map.contains_key(*value) {
|
||||
return Err(format!("{} cannot be blank", value));
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
9
src/api/mod.rs
Normal file
9
src/api/mod.rs
Normal file
@@ -0,0 +1,9 @@
|
||||
mod core;
|
||||
mod icons;
|
||||
mod identity;
|
||||
mod web;
|
||||
|
||||
pub use self::core::routes as core_routes;
|
||||
pub use self::icons::routes as icons_routes;
|
||||
pub use self::identity::routes as identity_routes;
|
||||
pub use self::web::routes as web_routes;
|
||||
43
src/api/web.rs
Normal file
43
src/api/web.rs
Normal file
@@ -0,0 +1,43 @@
|
||||
use std::io;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use rocket::Route;
|
||||
use rocket::response::NamedFile;
|
||||
use rocket_contrib::{Json, Value};
|
||||
|
||||
use auth::Headers;
|
||||
|
||||
use CONFIG;
|
||||
|
||||
pub fn routes() -> Vec<Route> {
|
||||
routes![index, files, attachments, alive]
|
||||
}
|
||||
|
||||
// TODO: Might want to use in memory cache: https://github.com/hgzimmerman/rocket-file-cache
|
||||
#[get("/")]
|
||||
fn index() -> io::Result<NamedFile> {
|
||||
NamedFile::open(Path::new(&CONFIG.web_vault_folder).join("index.html"))
|
||||
}
|
||||
|
||||
#[get("/<p..>")] // Only match this if the other routes don't match
|
||||
fn files(p: PathBuf) -> io::Result<NamedFile> {
|
||||
NamedFile::open(Path::new(&CONFIG.web_vault_folder).join(p))
|
||||
}
|
||||
|
||||
#[get("/attachments/<uuid>/<file..>")]
|
||||
fn attachments(uuid: String, file: PathBuf, headers: Headers) -> io::Result<NamedFile> {
|
||||
if uuid != headers.user.uuid {
|
||||
return Err(io::Error::new(io::ErrorKind::PermissionDenied, "Permission denied"));
|
||||
}
|
||||
|
||||
NamedFile::open(Path::new(&CONFIG.attachments_folder).join(file))
|
||||
}
|
||||
|
||||
|
||||
#[get("/alive")]
|
||||
fn alive() -> Json<String> {
|
||||
use util::format_date;
|
||||
use chrono::{NaiveDateTime, Utc};
|
||||
|
||||
Json(format_date(&Utc::now().naive_utc()))
|
||||
}
|
||||
Reference in New Issue
Block a user