diff --git a/.env b/.env index db64c9e25..344ede6fc 100644 --- a/.env +++ b/.env @@ -11,6 +11,10 @@ DEFGUARD_AUTH_SESSION_LIFETIME=604800 DEFGUARD_ADMIN_GROUPNAME=admin DEFGUARD_DEFAULT_ADMIN_PASSWORD=pass123 +### Proxy configuration ### +# Optional. URL of proxy gRPC server +# DEFGUARD_PROXY_URL: http://localhost:50051 + ### LDAP configuration ### DEFGUARD_LDAP_URL=ldap://localhost:389 DEFGUARD_LDAP_SERVICE_PASSWORD=adminpassword diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 01732df3f..8fbcfe86b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ env: jobs: test: runs-on: [self-hosted, Linux] - container: rust:1.74 + container: rust:1.75 services: postgres: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index f4fed2500..8bec6c503 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -16,7 +16,7 @@ env: jobs: rustdoc: runs-on: [self-hosted, Linux] - container: rust:1.74 + container: rust:1.75 services: postgres: image: postgres:15-alpine diff --git a/.sqlx/query-eb982489a09c45fcaec74346f499c657d3018d01be7e095683a40160d533f410.json b/.sqlx/query-00454ac37de808986d66b6abd808fb648b288f49586113cea21d889dca9655b9.json similarity index 78% rename from .sqlx/query-eb982489a09c45fcaec74346f499c657d3018d01be7e095683a40160d533f410.json rename to .sqlx/query-00454ac37de808986d66b6abd808fb648b288f49586113cea21d889dca9655b9.json index 5e191c1e1..e91d531de 100644 --- a/.sqlx/query-eb982489a09c45fcaec74346f499c657d3018d01be7e095683a40160d533f410.json +++ b/.sqlx/query-00454ac37de808986d66b6abd808fb648b288f49586113cea21d889dca9655b9.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT instance_name, main_logo_url, nav_logo_url, wireguard_enabled, webhooks_enabled, worker_enabled, openid_enabled FROM settings WHERE id = 1;\n ", + "query": "SELECT instance_name, main_logo_url, nav_logo_url, wireguard_enabled, webhooks_enabled, worker_enabled, openid_enabled FROM settings WHERE id = 1", "describe": { "columns": [ { @@ -52,5 +52,5 @@ false ] }, - "hash": "eb982489a09c45fcaec74346f499c657d3018d01be7e095683a40160d533f410" + "hash": "00454ac37de808986d66b6abd808fb648b288f49586113cea21d889dca9655b9" } diff --git a/.sqlx/query-e7e944f6bce4dce8cd58889dca8e38ceab97af014b51bfa24933e296e803effc.json b/.sqlx/query-035360e0dd260aece5c89979b28e87a85eb04e2b0eec2d9bc63e8fee6abda27e.json similarity index 53% rename from .sqlx/query-e7e944f6bce4dce8cd58889dca8e38ceab97af014b51bfa24933e296e803effc.json rename to .sqlx/query-035360e0dd260aece5c89979b28e87a85eb04e2b0eec2d9bc63e8fee6abda27e.json index eb7659098..30fd8c341 100644 --- a/.sqlx/query-e7e944f6bce4dce8cd58889dca8e38ceab97af014b51bfa24933e296e803effc.json +++ b/.sqlx/query-035360e0dd260aece5c89979b28e87a85eb04e2b0eec2d9bc63e8fee6abda27e.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT wireguard_ip\n FROM wireguard_network_device\n WHERE device_id = $1 AND wireguard_network_id = $2\n ", + "query": "SELECT wireguard_ip FROM wireguard_network_device WHERE device_id = $1 AND wireguard_network_id = $2", "describe": { "columns": [ { @@ -19,5 +19,5 @@ false ] }, - "hash": "e7e944f6bce4dce8cd58889dca8e38ceab97af014b51bfa24933e296e803effc" + "hash": "035360e0dd260aece5c89979b28e87a85eb04e2b0eec2d9bc63e8fee6abda27e" } diff --git a/.sqlx/query-727ed093b693f0f48e83779f9ee58de725cbec807ae286ae5900f426f2492f9d.json b/.sqlx/query-05c7cfa839d4411955c207095336861c744c520880d33815044babe0eff1d644.json similarity index 55% rename from .sqlx/query-727ed093b693f0f48e83779f9ee58de725cbec807ae286ae5900f426f2492f9d.json rename to .sqlx/query-05c7cfa839d4411955c207095336861c744c520880d33815044babe0eff1d644.json index 3bb8b2509..e656542bd 100644 --- a/.sqlx/query-727ed093b693f0f48e83779f9ee58de725cbec807ae286ae5900f426f2492f9d.json +++ b/.sqlx/query-05c7cfa839d4411955c207095336861c744c520880d33815044babe0eff1d644.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "UPDATE enrollment SET used_at = $1 WHERE id = $2", + "query": "UPDATE token SET used_at = $1 WHERE id = $2", "describe": { "columns": [], "parameters": { @@ -11,5 +11,5 @@ }, "nullable": [] }, - "hash": "727ed093b693f0f48e83779f9ee58de725cbec807ae286ae5900f426f2492f9d" + "hash": "05c7cfa839d4411955c207095336861c744c520880d33815044babe0eff1d644" } diff --git a/.sqlx/query-06888dd28b82c3b72612889932adba022ef520a90d23903c84595f0502e86e1d.json b/.sqlx/query-06888dd28b82c3b72612889932adba022ef520a90d23903c84595f0502e86e1d.json new file mode 100644 index 000000000..68d237eba --- /dev/null +++ b/.sqlx/query-06888dd28b82c3b72612889932adba022ef520a90d23903c84595f0502e86e1d.json @@ -0,0 +1,131 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT id \"id?\", username, password_hash, last_name, first_name, email, phone, ssh_key, pgp_key, pgp_cert_id, mfa_enabled, totp_enabled, email_mfa_enabled, totp_secret, email_mfa_secret, mfa_method \"mfa_method: _\", recovery_codes FROM \"user\" WHERE email = $1", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "id?", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "username", + "type_info": "Text" + }, + { + "ordinal": 2, + "name": "password_hash", + "type_info": "Text" + }, + { + "ordinal": 3, + "name": "last_name", + "type_info": "Text" + }, + { + "ordinal": 4, + "name": "first_name", + "type_info": "Text" + }, + { + "ordinal": 5, + "name": "email", + "type_info": "Text" + }, + { + "ordinal": 6, + "name": "phone", + "type_info": "Text" + }, + { + "ordinal": 7, + "name": "ssh_key", + "type_info": "Text" + }, + { + "ordinal": 8, + "name": "pgp_key", + "type_info": "Text" + }, + { + "ordinal": 9, + "name": "pgp_cert_id", + "type_info": "Text" + }, + { + "ordinal": 10, + "name": "mfa_enabled", + "type_info": "Bool" + }, + { + "ordinal": 11, + "name": "totp_enabled", + "type_info": "Bool" + }, + { + "ordinal": 12, + "name": "email_mfa_enabled", + "type_info": "Bool" + }, + { + "ordinal": 13, + "name": "totp_secret", + "type_info": "Bytea" + }, + { + "ordinal": 14, + "name": "email_mfa_secret", + "type_info": "Bytea" + }, + { + "ordinal": 15, + "name": "mfa_method: _", + "type_info": { + "Custom": { + "name": "mfa_method", + "kind": { + "Enum": [ + "none", + "one_time_password", + "webauthn", + "web3", + "email" + ] + } + } + } + }, + { + "ordinal": 16, + "name": "recovery_codes", + "type_info": "TextArray" + } + ], + "parameters": { + "Left": [ + "Text" + ] + }, + "nullable": [ + false, + false, + true, + false, + false, + false, + true, + true, + true, + true, + false, + false, + false, + true, + true, + false, + false + ] + }, + "hash": "06888dd28b82c3b72612889932adba022ef520a90d23903c84595f0502e86e1d" +} diff --git a/.sqlx/query-06d1ac982dc99c5dae010089cfb73a044397c5cb6bb9654dc5df420bf00d2955.json b/.sqlx/query-06d1ac982dc99c5dae010089cfb73a044397c5cb6bb9654dc5df420bf00d2955.json new file mode 100644 index 000000000..e2fcfb80f --- /dev/null +++ b/.sqlx/query-06d1ac982dc99c5dae010089cfb73a044397c5cb6bb9654dc5df420bf00d2955.json @@ -0,0 +1,24 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT latest_handshake \"latest_handshake: NaiveDateTime\" FROM wireguard_peer_stats_view WHERE device_id = $1 AND latest_handshake IS NOT NULL AND (latest_handshake_diff > $2 * interval '1 minute' OR latest_handshake_diff IS NULL) AND network = $3 ORDER BY collected_at DESC LIMIT 1", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "latest_handshake: NaiveDateTime", + "type_info": "Timestamp" + } + ], + "parameters": { + "Left": [ + "Int8", + "Float8", + "Int8" + ] + }, + "nullable": [ + true + ] + }, + "hash": "06d1ac982dc99c5dae010089cfb73a044397c5cb6bb9654dc5df420bf00d2955" +} diff --git a/.sqlx/query-6b07d6ea56bcded73038dfd59cff3d7d15049caf771aec6b0fcd42bea7169998.json b/.sqlx/query-0c5df6263cfa9e2bdf273c51993d40442a7ed65c986eef4e79e9d12aeb32edef.json similarity index 69% rename from .sqlx/query-6b07d6ea56bcded73038dfd59cff3d7d15049caf771aec6b0fcd42bea7169998.json rename to .sqlx/query-0c5df6263cfa9e2bdf273c51993d40442a7ed65c986eef4e79e9d12aeb32edef.json index 1794b02be..3116a4814 100644 --- a/.sqlx/query-6b07d6ea56bcded73038dfd59cff3d7d15049caf771aec6b0fcd42bea7169998.json +++ b/.sqlx/query-0c5df6263cfa9e2bdf273c51993d40442a7ed65c986eef4e79e9d12aeb32edef.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT id \"id?\", \"name\",\"address\" \"address: _\",\"port\",\"pubkey\",\"prvkey\",\"endpoint\",\"dns\",\"allowed_ips\" \"allowed_ips: _\",\"connected_at\" FROM \"wireguard_network\"", + "query": "SELECT id \"id?\", \"name\",\"address\" \"address: _\",\"port\",\"pubkey\",\"prvkey\",\"endpoint\",\"dns\",\"allowed_ips\" \"allowed_ips: _\",\"connected_at\",\"mfa_enabled\",\"keepalive_interval\",\"peer_disconnect_threshold\" FROM \"wireguard_network\"", "describe": { "columns": [ { @@ -52,6 +52,21 @@ "ordinal": 9, "name": "connected_at", "type_info": "Timestamp" + }, + { + "ordinal": 10, + "name": "mfa_enabled", + "type_info": "Bool" + }, + { + "ordinal": 11, + "name": "keepalive_interval", + "type_info": "Int4" + }, + { + "ordinal": 12, + "name": "peer_disconnect_threshold", + "type_info": "Int4" } ], "parameters": { @@ -67,8 +82,11 @@ false, true, false, - true + true, + false, + false, + false ] }, - "hash": "6b07d6ea56bcded73038dfd59cff3d7d15049caf771aec6b0fcd42bea7169998" + "hash": "0c5df6263cfa9e2bdf273c51993d40442a7ed65c986eef4e79e9d12aeb32edef" } diff --git a/.sqlx/query-0cf5e325412549a381f4a2309ccbdc9289ef5ce5169c5b8c853e7c4e7dfb1877.json b/.sqlx/query-0cf5e325412549a381f4a2309ccbdc9289ef5ce5169c5b8c853e7c4e7dfb1877.json new file mode 100644 index 000000000..f3444d949 --- /dev/null +++ b/.sqlx/query-0cf5e325412549a381f4a2309ccbdc9289ef5ce5169c5b8c853e7c4e7dfb1877.json @@ -0,0 +1,22 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT name FROM wireguard_network_allowed_group wag JOIN \"group\" g ON wag.group_id = g.id WHERE wag.network_id = $1", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "name", + "type_info": "Text" + } + ], + "parameters": { + "Left": [ + "Int8" + ] + }, + "nullable": [ + false + ] + }, + "hash": "0cf5e325412549a381f4a2309ccbdc9289ef5ce5169c5b8c853e7c4e7dfb1877" +} diff --git a/.sqlx/query-1a01b8b88444b493abf74b2ec0ad649018244de3c7f23d98bfab71faa1a9fae1.json b/.sqlx/query-1a01b8b88444b493abf74b2ec0ad649018244de3c7f23d98bfab71faa1a9fae1.json new file mode 100644 index 000000000..c6790b55f --- /dev/null +++ b/.sqlx/query-1a01b8b88444b493abf74b2ec0ad649018244de3c7f23d98bfab71faa1a9fae1.json @@ -0,0 +1,92 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT id as \"id?\", name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, connected_at, mfa_enabled, keepalive_interval, peer_disconnect_threshold FROM wireguard_network WHERE mfa_enabled = true", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "id?", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "name", + "type_info": "Text" + }, + { + "ordinal": 2, + "name": "address", + "type_info": "Inet" + }, + { + "ordinal": 3, + "name": "port", + "type_info": "Int4" + }, + { + "ordinal": 4, + "name": "pubkey", + "type_info": "Text" + }, + { + "ordinal": 5, + "name": "prvkey", + "type_info": "Text" + }, + { + "ordinal": 6, + "name": "endpoint", + "type_info": "Text" + }, + { + "ordinal": 7, + "name": "dns", + "type_info": "Text" + }, + { + "ordinal": 8, + "name": "allowed_ips", + "type_info": "InetArray" + }, + { + "ordinal": 9, + "name": "connected_at", + "type_info": "Timestamp" + }, + { + "ordinal": 10, + "name": "mfa_enabled", + "type_info": "Bool" + }, + { + "ordinal": 11, + "name": "keepalive_interval", + "type_info": "Int4" + }, + { + "ordinal": 12, + "name": "peer_disconnect_threshold", + "type_info": "Int4" + } + ], + "parameters": { + "Left": [] + }, + "nullable": [ + false, + false, + false, + false, + false, + false, + false, + true, + false, + true, + false, + false, + false + ] + }, + "hash": "1a01b8b88444b493abf74b2ec0ad649018244de3c7f23d98bfab71faa1a9fae1" +} diff --git a/.sqlx/query-1bb3c8ecbd6500717d639678e08ab52c14293fa64d260db812c89ed43a5a7cc8.json b/.sqlx/query-1bb3c8ecbd6500717d639678e08ab52c14293fa64d260db812c89ed43a5a7cc8.json new file mode 100644 index 000000000..8d314a5fa --- /dev/null +++ b/.sqlx/query-1bb3c8ecbd6500717d639678e08ab52c14293fa64d260db812c89ed43a5a7cc8.json @@ -0,0 +1,15 @@ +{ + "db_name": "PostgreSQL", + "query": "UPDATE session SET expires = $1 WHERE id = $2", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Timestamp", + "Text" + ] + }, + "nullable": [] + }, + "hash": "1bb3c8ecbd6500717d639678e08ab52c14293fa64d260db812c89ed43a5a7cc8" +} diff --git a/.sqlx/query-501e4426106d4972d7bd6d769bb6dd239be2168c4afdfc618de4c7facaad67a3.json b/.sqlx/query-20dda55cfcf38db23d5553b65a9e4f48275d7b1d588869791a6741fa11be38a5.json similarity index 70% rename from .sqlx/query-501e4426106d4972d7bd6d769bb6dd239be2168c4afdfc618de4c7facaad67a3.json rename to .sqlx/query-20dda55cfcf38db23d5553b65a9e4f48275d7b1d588869791a6741fa11be38a5.json index 5c396350e..4b6e6f131 100644 --- a/.sqlx/query-501e4426106d4972d7bd6d769bb6dd239be2168c4afdfc618de4c7facaad67a3.json +++ b/.sqlx/query-20dda55cfcf38db23d5553b65a9e4f48275d7b1d588869791a6741fa11be38a5.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT id \"id?\", device_id \"device_id!\", collected_at \"collected_at!\", network \"network!\",\n endpoint, upload \"upload!\", download \"download!\", latest_handshake \"latest_handshake!\", allowed_ips\n FROM wireguard_peer_stats\n WHERE device_id = $1 AND network = $2\n ORDER BY collected_at DESC\n LIMIT 1\n ", + "query": "SELECT id \"id?\", device_id \"device_id!\", collected_at \"collected_at!\", network \"network!\", endpoint, upload \"upload!\", download \"download!\", latest_handshake \"latest_handshake!\", allowed_ips FROM wireguard_peer_stats WHERE device_id = $1 AND network = $2 ORDER BY collected_at DESC LIMIT 1", "describe": { "columns": [ { @@ -67,5 +67,5 @@ true ] }, - "hash": "501e4426106d4972d7bd6d769bb6dd239be2168c4afdfc618de4c7facaad67a3" + "hash": "20dda55cfcf38db23d5553b65a9e4f48275d7b1d588869791a6741fa11be38a5" } diff --git a/.sqlx/query-71e9c3921543a990ba6c6a8a0a9254757a1208ea9bfb2e0570626a39f8463467.json b/.sqlx/query-2444fb3a5c12155737d934d156a63716a6383680dee11e01682597e24bf3ce53.json similarity index 79% rename from .sqlx/query-71e9c3921543a990ba6c6a8a0a9254757a1208ea9bfb2e0570626a39f8463467.json rename to .sqlx/query-2444fb3a5c12155737d934d156a63716a6383680dee11e01682597e24bf3ce53.json index 6095c37cf..94fdee55e 100644 --- a/.sqlx/query-71e9c3921543a990ba6c6a8a0a9254757a1208ea9bfb2e0570626a39f8463467.json +++ b/.sqlx/query-2444fb3a5c12155737d934d156a63716a6383680dee11e01682597e24bf3ce53.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at FROM enrollment WHERE id = $1", + "query": "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at, token_type FROM token WHERE id = $1", "describe": { "columns": [ { @@ -37,6 +37,11 @@ "ordinal": 6, "name": "used_at", "type_info": "Timestamp" + }, + { + "ordinal": 7, + "name": "token_type", + "type_info": "Text" } ], "parameters": { @@ -47,12 +52,13 @@ "nullable": [ false, false, - false, + true, true, false, false, + true, true ] }, - "hash": "71e9c3921543a990ba6c6a8a0a9254757a1208ea9bfb2e0570626a39f8463467" + "hash": "2444fb3a5c12155737d934d156a63716a6383680dee11e01682597e24bf3ce53" } diff --git a/.sqlx/query-26d95a39c9d11c1fcd5d35f4f0d8883b366b46937b94f25a3788604c72da0ecc.json b/.sqlx/query-26d95a39c9d11c1fcd5d35f4f0d8883b366b46937b94f25a3788604c72da0ecc.json new file mode 100644 index 000000000..9076e114d --- /dev/null +++ b/.sqlx/query-26d95a39c9d11c1fcd5d35f4f0d8883b366b46937b94f25a3788604c72da0ecc.json @@ -0,0 +1,14 @@ +{ + "db_name": "PostgreSQL", + "query": "DELETE FROM token WHERE user_id = $1 AND token_type = 'PASSWORD_RESET' AND used_at IS NULL", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8" + ] + }, + "nullable": [] + }, + "hash": "26d95a39c9d11c1fcd5d35f4f0d8883b366b46937b94f25a3788604c72da0ecc" +} diff --git a/.sqlx/query-b362d79ac6b116c97f7489cbfc5801c7f94ba91677af351ef235755bf804e1f7.json b/.sqlx/query-29809d24769e1c6cb572c666fd0caeeaeb3b13a524f503b21414d1394173eb24.json similarity index 69% rename from .sqlx/query-b362d79ac6b116c97f7489cbfc5801c7f94ba91677af351ef235755bf804e1f7.json rename to .sqlx/query-29809d24769e1c6cb572c666fd0caeeaeb3b13a524f503b21414d1394173eb24.json index 7634f9654..ffaf6c210 100644 --- a/.sqlx/query-b362d79ac6b116c97f7489cbfc5801c7f94ba91677af351ef235755bf804e1f7.json +++ b/.sqlx/query-29809d24769e1c6cb572c666fd0caeeaeb3b13a524f503b21414d1394173eb24.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT id \"id?\", \"name\",\"address\" \"address: _\",\"port\",\"pubkey\",\"prvkey\",\"endpoint\",\"dns\",\"allowed_ips\" \"allowed_ips: _\",\"connected_at\" FROM \"wireguard_network\" WHERE id = $1", + "query": "SELECT id \"id?\", \"name\",\"address\" \"address: _\",\"port\",\"pubkey\",\"prvkey\",\"endpoint\",\"dns\",\"allowed_ips\" \"allowed_ips: _\",\"connected_at\",\"mfa_enabled\",\"keepalive_interval\",\"peer_disconnect_threshold\" FROM \"wireguard_network\" WHERE id = $1", "describe": { "columns": [ { @@ -52,6 +52,21 @@ "ordinal": 9, "name": "connected_at", "type_info": "Timestamp" + }, + { + "ordinal": 10, + "name": "mfa_enabled", + "type_info": "Bool" + }, + { + "ordinal": 11, + "name": "keepalive_interval", + "type_info": "Int4" + }, + { + "ordinal": 12, + "name": "peer_disconnect_threshold", + "type_info": "Int4" } ], "parameters": { @@ -69,8 +84,11 @@ false, true, false, - true + true, + false, + false, + false ] }, - "hash": "b362d79ac6b116c97f7489cbfc5801c7f94ba91677af351ef235755bf804e1f7" + "hash": "29809d24769e1c6cb572c666fd0caeeaeb3b13a524f503b21414d1394173eb24" } diff --git a/.sqlx/query-73ab0d514bbce0a69e1b22d9f5a2a58be7427882b368eef4d45529e9e85d885c.json b/.sqlx/query-38f3ad2dc19d222226b85a10d6c83e209cf075f9b128ed33908c73cd74297d81.json similarity index 65% rename from .sqlx/query-73ab0d514bbce0a69e1b22d9f5a2a58be7427882b368eef4d45529e9e85d885c.json rename to .sqlx/query-38f3ad2dc19d222226b85a10d6c83e209cf075f9b128ed33908c73cd74297d81.json index 847391cec..d187d6402 100644 --- a/.sqlx/query-73ab0d514bbce0a69e1b22d9f5a2a58be7427882b368eef4d45529e9e85d885c.json +++ b/.sqlx/query-38f3ad2dc19d222226b85a10d6c83e209cf075f9b128ed33908c73cd74297d81.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "UPDATE \"wireguard_network\" SET \"name\" = $2,\"address\" = $3,\"port\" = $4,\"pubkey\" = $5,\"prvkey\" = $6,\"endpoint\" = $7,\"dns\" = $8,\"allowed_ips\" = $9,\"connected_at\" = $10 WHERE id = $1", + "query": "UPDATE \"wireguard_network\" SET \"name\" = $2,\"address\" = $3,\"port\" = $4,\"pubkey\" = $5,\"prvkey\" = $6,\"endpoint\" = $7,\"dns\" = $8,\"allowed_ips\" = $9,\"connected_at\" = $10,\"mfa_enabled\" = $11,\"keepalive_interval\" = $12,\"peer_disconnect_threshold\" = $13 WHERE id = $1", "describe": { "columns": [], "parameters": { @@ -14,10 +14,13 @@ "Text", "Text", "InetArray", - "Timestamp" + "Timestamp", + "Bool", + "Int4", + "Int4" ] }, "nullable": [] }, - "hash": "73ab0d514bbce0a69e1b22d9f5a2a58be7427882b368eef4d45529e9e85d885c" + "hash": "38f3ad2dc19d222226b85a10d6c83e209cf075f9b128ed33908c73cd74297d81" } diff --git a/.sqlx/query-3d5d8b6f640435a1986561c73cd809038cdddfb44133b97b5ba7392573239539.json b/.sqlx/query-3d5d8b6f640435a1986561c73cd809038cdddfb44133b97b5ba7392573239539.json new file mode 100644 index 000000000..3dd50e700 --- /dev/null +++ b/.sqlx/query-3d5d8b6f640435a1986561c73cd809038cdddfb44133b97b5ba7392573239539.json @@ -0,0 +1,29 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT COALESCE(COUNT(DISTINCT(u.id)), 0) as \"active_users!\", COALESCE(COUNT(DISTINCT(s.device_id)), 0) as \"active_devices!\" FROM \"user\" u JOIN device d ON d.user_id = u.id JOIN wireguard_peer_stats s ON s.device_id = d.id WHERE latest_handshake >= $1 AND s.network = $2", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "active_users!", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "active_devices!", + "type_info": "Int8" + } + ], + "parameters": { + "Left": [ + "Timestamp", + "Int8" + ] + }, + "nullable": [ + null, + null + ] + }, + "hash": "3d5d8b6f640435a1986561c73cd809038cdddfb44133b97b5ba7392573239539" +} diff --git a/.sqlx/query-929535564469ee1701f83a1489301d0d652d5452369a2dce933f032cdb7092e2.json b/.sqlx/query-3e6fa53cc900724e25e127f472cb0cb5b5e76fbcf424a79b94862f623ea975fc.json similarity index 74% rename from .sqlx/query-929535564469ee1701f83a1489301d0d652d5452369a2dce933f032cdb7092e2.json rename to .sqlx/query-3e6fa53cc900724e25e127f472cb0cb5b5e76fbcf424a79b94862f623ea975fc.json index 8a1e90ee9..431b7f8fa 100644 --- a/.sqlx/query-929535564469ee1701f83a1489301d0d652d5452369a2dce933f032cdb7092e2.json +++ b/.sqlx/query-3e6fa53cc900724e25e127f472cb0cb5b5e76fbcf424a79b94862f623ea975fc.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT device.id \"id?\", name, wireguard_pubkey, user_id, created\n FROM device WHERE user_id = $1\n ", + "query": "SELECT device.id \"id?\", name, wireguard_pubkey, user_id, created FROM device WHERE user_id = $1", "describe": { "columns": [ { @@ -42,5 +42,5 @@ false ] }, - "hash": "929535564469ee1701f83a1489301d0d652d5452369a2dce933f032cdb7092e2" + "hash": "3e6fa53cc900724e25e127f472cb0cb5b5e76fbcf424a79b94862f623ea975fc" } diff --git a/.sqlx/query-4183b4f169126bcc511ff76c7554622fc71857d0d459588b4f3934307611aee7.json b/.sqlx/query-4183b4f169126bcc511ff76c7554622fc71857d0d459588b4f3934307611aee7.json deleted file mode 100644 index e2761039f..000000000 --- a/.sqlx/query-4183b4f169126bcc511ff76c7554622fc71857d0d459588b4f3934307611aee7.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n SELECT\n COALESCE(COUNT(DISTINCT(u.id)), 0) as \"active_users!\",\n COALESCE(COUNT(DISTINCT(s.device_id)), 0) as \"active_devices!\"\n FROM \"user\" u\n JOIN device d ON d.user_id = u.id\n JOIN wireguard_peer_stats s ON s.device_id = d.id\n WHERE latest_handshake >= $1 AND s.network = $2\n ", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "active_users!", - "type_info": "Int8" - }, - { - "ordinal": 1, - "name": "active_devices!", - "type_info": "Int8" - } - ], - "parameters": { - "Left": [ - "Timestamp", - "Int8" - ] - }, - "nullable": [ - null, - null - ] - }, - "hash": "4183b4f169126bcc511ff76c7554622fc71857d0d459588b4f3934307611aee7" -} diff --git a/.sqlx/query-4218fd109bd4a17b2a4551cfe0d14f2c9b6a37f25f0696d83078dae2c9f87c5f.json b/.sqlx/query-4218fd109bd4a17b2a4551cfe0d14f2c9b6a37f25f0696d83078dae2c9f87c5f.json new file mode 100644 index 000000000..5354828a7 --- /dev/null +++ b/.sqlx/query-4218fd109bd4a17b2a4551cfe0d14f2c9b6a37f25f0696d83078dae2c9f87c5f.json @@ -0,0 +1,14 @@ +{ + "db_name": "PostgreSQL", + "query": "DELETE FROM wireguard_peer_stats WHERE collected_at < $1 AND (device_id, network, collected_at) NOT IN ( SELECT device_id, network, MAX(collected_at) FROM wireguard_peer_stats GROUP BY device_id, network)", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Timestamp" + ] + }, + "nullable": [] + }, + "hash": "4218fd109bd4a17b2a4551cfe0d14f2c9b6a37f25f0696d83078dae2c9f87c5f" +} diff --git a/.sqlx/query-05e3fce0c51856f6033195c7523a2b5fd1c2a7968a7abd27394422a7c93e8815.json b/.sqlx/query-42ccaa218d47638ff39d9006095ac30ae1cd9dce74ec826ed875c39cc05f04f8.json similarity index 54% rename from .sqlx/query-05e3fce0c51856f6033195c7523a2b5fd1c2a7968a7abd27394422a7c93e8815.json rename to .sqlx/query-42ccaa218d47638ff39d9006095ac30ae1cd9dce74ec826ed875c39cc05f04f8.json index 7b35afeb1..8b795c04a 100644 --- a/.sqlx/query-05e3fce0c51856f6033195c7523a2b5fd1c2a7968a7abd27394422a7c93e8815.json +++ b/.sqlx/query-42ccaa218d47638ff39d9006095ac30ae1cd9dce74ec826ed875c39cc05f04f8.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT\n date_trunc($1, collected_at) \"collected_at: NaiveDateTime\",\n cast(sum(upload) AS bigint) upload, cast(sum(download) AS bigint) download\n FROM wireguard_peer_stats_view\n WHERE collected_at >= $2 AND network = $3\n GROUP BY 1\n ORDER BY 1\n LIMIT $4\n ", + "query": "SELECT date_trunc($1, collected_at) \"collected_at: NaiveDateTime\", cast(sum(upload) AS bigint) upload, cast(sum(download) AS bigint) download FROM wireguard_peer_stats_view WHERE collected_at >= $2 AND network = $3 GROUP BY 1 ORDER BY 1 LIMIT $4", "describe": { "columns": [ { @@ -33,5 +33,5 @@ null ] }, - "hash": "05e3fce0c51856f6033195c7523a2b5fd1c2a7968a7abd27394422a7c93e8815" + "hash": "42ccaa218d47638ff39d9006095ac30ae1cd9dce74ec826ed875c39cc05f04f8" } diff --git a/.sqlx/query-43f040a77856123f0dadfef6aad302ecae6a6379c64b7686fdd7e6a6d32a9ed2.json b/.sqlx/query-43f040a77856123f0dadfef6aad302ecae6a6379c64b7686fdd7e6a6d32a9ed2.json new file mode 100644 index 000000000..5ca41ad85 --- /dev/null +++ b/.sqlx/query-43f040a77856123f0dadfef6aad302ecae6a6379c64b7686fdd7e6a6d32a9ed2.json @@ -0,0 +1,21 @@ +{ + "db_name": "PostgreSQL", + "query": "INSERT INTO token (id, user_id, admin_id, email, created_at, expires_at, used_at, token_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Text", + "Int8", + "Int8", + "Text", + "Timestamp", + "Timestamp", + "Timestamp", + "Text" + ] + }, + "nullable": [] + }, + "hash": "43f040a77856123f0dadfef6aad302ecae6a6379c64b7686fdd7e6a6d32a9ed2" +} diff --git a/.sqlx/query-8880011a898ca2b97b0cfdbf027509d4855f46e4871caaa1fc95f2f612efcc4b.json b/.sqlx/query-442aac6474b466acc15578483d7d582a6face350a9c4c11db8b32fc251605cd6.json similarity index 58% rename from .sqlx/query-8880011a898ca2b97b0cfdbf027509d4855f46e4871caaa1fc95f2f612efcc4b.json rename to .sqlx/query-442aac6474b466acc15578483d7d582a6face350a9c4c11db8b32fc251605cd6.json index bb241b225..7e6961bbf 100644 --- a/.sqlx/query-8880011a898ca2b97b0cfdbf027509d4855f46e4871caaa1fc95f2f612efcc4b.json +++ b/.sqlx/query-442aac6474b466acc15578483d7d582a6face350a9c4c11db8b32fc251605cd6.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\"\n FROM wireguard_network_device WHERE device_id = $1", + "query": "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\", preshared_key, is_authorized FROM wireguard_network_device WHERE device_id = $1", "describe": { "columns": [ { @@ -17,6 +17,16 @@ "ordinal": 2, "name": "wireguard_ip: IpAddr", "type_info": "Inet" + }, + { + "ordinal": 3, + "name": "preshared_key", + "type_info": "Text" + }, + { + "ordinal": 4, + "name": "is_authorized", + "type_info": "Bool" } ], "parameters": { @@ -27,8 +37,10 @@ "nullable": [ false, false, + false, + true, false ] }, - "hash": "8880011a898ca2b97b0cfdbf027509d4855f46e4871caaa1fc95f2f612efcc4b" + "hash": "442aac6474b466acc15578483d7d582a6face350a9c4c11db8b32fc251605cd6" } diff --git a/.sqlx/query-45545d3190c14bb3e9528ab3d3a8522209f36956f65bf5a126682d5477db425e.json b/.sqlx/query-45545d3190c14bb3e9528ab3d3a8522209f36956f65bf5a126682d5477db425e.json deleted file mode 100644 index 02e887ea1..000000000 --- a/.sqlx/query-45545d3190c14bb3e9528ab3d3a8522209f36956f65bf5a126682d5477db425e.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n UPDATE wireguard_network_device\n SET wireguard_ip = $3\n WHERE device_id = $1 AND wireguard_network_id = $2\n ", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Int8", - "Int8", - "Inet" - ] - }, - "nullable": [] - }, - "hash": "45545d3190c14bb3e9528ab3d3a8522209f36956f65bf5a126682d5477db425e" -} diff --git a/.sqlx/query-bde600b9d9448806df37628d305a09b93f4d1217dfb1141a32be11673d76dd1f.json b/.sqlx/query-45a53587f6d8bee3de695b846d5bf85dbcf3fb1a202611480af6a7b9e28d864f.json similarity index 68% rename from .sqlx/query-bde600b9d9448806df37628d305a09b93f4d1217dfb1141a32be11673d76dd1f.json rename to .sqlx/query-45a53587f6d8bee3de695b846d5bf85dbcf3fb1a202611480af6a7b9e28d864f.json index 840991111..57db8db09 100644 --- a/.sqlx/query-bde600b9d9448806df37628d305a09b93f4d1217dfb1141a32be11673d76dd1f.json +++ b/.sqlx/query-45a53587f6d8bee3de695b846d5bf85dbcf3fb1a202611480af6a7b9e28d864f.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT id as \"id?\", name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, connected_at FROM wireguard_network WHERE name = $1", + "query": "SELECT id as \"id?\", name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, connected_at, mfa_enabled, keepalive_interval, peer_disconnect_threshold FROM wireguard_network WHERE name = $1", "describe": { "columns": [ { @@ -52,6 +52,21 @@ "ordinal": 9, "name": "connected_at", "type_info": "Timestamp" + }, + { + "ordinal": 10, + "name": "mfa_enabled", + "type_info": "Bool" + }, + { + "ordinal": 11, + "name": "keepalive_interval", + "type_info": "Int4" + }, + { + "ordinal": 12, + "name": "peer_disconnect_threshold", + "type_info": "Int4" } ], "parameters": { @@ -69,8 +84,11 @@ false, true, false, - true + true, + false, + false, + false ] }, - "hash": "bde600b9d9448806df37628d305a09b93f4d1217dfb1141a32be11673d76dd1f" + "hash": "45a53587f6d8bee3de695b846d5bf85dbcf3fb1a202611480af6a7b9e28d864f" } diff --git a/.sqlx/query-66d2e2f3156ce802a0018bea5aa0718b2ce599d44de6382e854174053a639f5a.json b/.sqlx/query-481658620e98faa574e26fe49abbecafa1166f16151c69b465cd49f334de7190.json similarity index 57% rename from .sqlx/query-66d2e2f3156ce802a0018bea5aa0718b2ce599d44de6382e854174053a639f5a.json rename to .sqlx/query-481658620e98faa574e26fe49abbecafa1166f16151c69b465cd49f334de7190.json index f1a5f025f..b3830140f 100644 --- a/.sqlx/query-66d2e2f3156ce802a0018bea5aa0718b2ce599d44de6382e854174053a639f5a.json +++ b/.sqlx/query-481658620e98faa574e26fe49abbecafa1166f16151c69b465cd49f334de7190.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\" FROM\n wireguard_network_device\n WHERE device_id = $1 AND wireguard_network_id = $2", + "query": "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\", preshared_key, is_authorized FROM wireguard_network_device WHERE device_id = $1 AND wireguard_network_id = $2", "describe": { "columns": [ { @@ -17,6 +17,16 @@ "ordinal": 2, "name": "wireguard_ip: IpAddr", "type_info": "Inet" + }, + { + "ordinal": 3, + "name": "preshared_key", + "type_info": "Text" + }, + { + "ordinal": 4, + "name": "is_authorized", + "type_info": "Bool" } ], "parameters": { @@ -28,8 +38,10 @@ "nullable": [ false, false, + false, + true, false ] }, - "hash": "66d2e2f3156ce802a0018bea5aa0718b2ce599d44de6382e854174053a639f5a" + "hash": "481658620e98faa574e26fe49abbecafa1166f16151c69b465cd49f334de7190" } diff --git a/.sqlx/query-48966c8c5f8999dad107a7c49d7c17f6a3a3b1bda1412df2b30bf2f770d70e8f.json b/.sqlx/query-48966c8c5f8999dad107a7c49d7c17f6a3a3b1bda1412df2b30bf2f770d70e8f.json new file mode 100644 index 000000000..20ce12f88 --- /dev/null +++ b/.sqlx/query-48966c8c5f8999dad107a7c49d7c17f6a3a3b1bda1412df2b30bf2f770d70e8f.json @@ -0,0 +1,14 @@ +{ + "db_name": "PostgreSQL", + "query": "DELETE FROM token WHERE user_id = $1 AND used_at IS NULL", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8" + ] + }, + "nullable": [] + }, + "hash": "48966c8c5f8999dad107a7c49d7c17f6a3a3b1bda1412df2b30bf2f770d70e8f" +} diff --git a/.sqlx/query-4f318cd5100bf4d155a555b927cc7421cb5324f70e427bd7e6f7312be4a20946.json b/.sqlx/query-4f318cd5100bf4d155a555b927cc7421cb5324f70e427bd7e6f7312be4a20946.json deleted file mode 100644 index c3f53658b..000000000 --- a/.sqlx/query-4f318cd5100bf4d155a555b927cc7421cb5324f70e427bd7e6f7312be4a20946.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n DELETE FROM wireguard_network_allowed_group\n WHERE network_id = $1 AND group_id IN (\n SELECT id\n FROM \"group\"\n WHERE name IN (SELECT * FROM UNNEST($2::text[]))\n )\n ", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Int8", - "TextArray" - ] - }, - "nullable": [] - }, - "hash": "4f318cd5100bf4d155a555b927cc7421cb5324f70e427bd7e6f7312be4a20946" -} diff --git a/.sqlx/query-865131a7e440c7e5f297cb8620487fe0cf641f481175adaf22982d1f983d362e.json b/.sqlx/query-5f1da7400599669d9591f6dded6c38d6f74286fd5660c1ccae20ce43617bbc8f.json similarity index 57% rename from .sqlx/query-865131a7e440c7e5f297cb8620487fe0cf641f481175adaf22982d1f983d362e.json rename to .sqlx/query-5f1da7400599669d9591f6dded6c38d6f74286fd5660c1ccae20ce43617bbc8f.json index 53638cdc0..fbd018000 100644 --- a/.sqlx/query-865131a7e440c7e5f297cb8620487fe0cf641f481175adaf22982d1f983d362e.json +++ b/.sqlx/query-5f1da7400599669d9591f6dded6c38d6f74286fd5660c1ccae20ce43617bbc8f.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n WITH s AS (\n SELECT DISTINCT ON (device_id) *\n FROM wireguard_peer_stats\n ORDER BY device_id, latest_handshake DESC\n )\n SELECT\n d.id \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created\n FROM device d\n JOIN s ON d.id = s.device_id\n WHERE s.latest_handshake >= $1 AND s.network = $2\n ", + "query": "WITH s AS ( SELECT DISTINCT ON (device_id) * FROM wireguard_peer_stats ORDER BY device_id, latest_handshake DESC ) SELECT d.id \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created FROM device d JOIN s ON d.id = s.device_id WHERE s.latest_handshake >= $1 AND s.network = $2", "describe": { "columns": [ { @@ -43,5 +43,5 @@ false ] }, - "hash": "865131a7e440c7e5f297cb8620487fe0cf641f481175adaf22982d1f983d362e" + "hash": "5f1da7400599669d9591f6dded6c38d6f74286fd5660c1ccae20ce43617bbc8f" } diff --git a/.sqlx/query-63dd22326d77a452d5624d378b0653a7b6b98d71caaf55c6651a44bbd57df017.json b/.sqlx/query-63dd22326d77a452d5624d378b0653a7b6b98d71caaf55c6651a44bbd57df017.json new file mode 100644 index 000000000..758eb4113 --- /dev/null +++ b/.sqlx/query-63dd22326d77a452d5624d378b0653a7b6b98d71caaf55c6651a44bbd57df017.json @@ -0,0 +1,40 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT wireguard_network_id as network_id, wireguard_ip as \"device_wireguard_ip: IpAddr\", preshared_key, is_authorized FROM wireguard_network_device WHERE device_id = $1", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "network_id", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "device_wireguard_ip: IpAddr", + "type_info": "Inet" + }, + { + "ordinal": 2, + "name": "preshared_key", + "type_info": "Text" + }, + { + "ordinal": 3, + "name": "is_authorized", + "type_info": "Bool" + } + ], + "parameters": { + "Left": [ + "Int8" + ] + }, + "nullable": [ + false, + false, + true, + false + ] + }, + "hash": "63dd22326d77a452d5624d378b0653a7b6b98d71caaf55c6651a44bbd57df017" +} diff --git a/.sqlx/query-6eb3f257ef7762c8633885b2b49d3f18033b11db0daf4133c2abaf8823a8a86a.json b/.sqlx/query-6eb3f257ef7762c8633885b2b49d3f18033b11db0daf4133c2abaf8823a8a86a.json new file mode 100644 index 000000000..ba14f8502 --- /dev/null +++ b/.sqlx/query-6eb3f257ef7762c8633885b2b49d3f18033b11db0daf4133c2abaf8823a8a86a.json @@ -0,0 +1,15 @@ +{ + "db_name": "PostgreSQL", + "query": "DELETE FROM wireguard_network_device WHERE device_id = $1 AND wireguard_network_id = $2", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8", + "Int8" + ] + }, + "nullable": [] + }, + "hash": "6eb3f257ef7762c8633885b2b49d3f18033b11db0daf4133c2abaf8823a8a86a" +} diff --git a/.sqlx/query-71465915aa72eed5d35fb82149a1bd32df7c4f5af1457dfa5406b3c82fb77231.json b/.sqlx/query-71465915aa72eed5d35fb82149a1bd32df7c4f5af1457dfa5406b3c82fb77231.json deleted file mode 100644 index 60581bbde..000000000 --- a/.sqlx/query-71465915aa72eed5d35fb82149a1bd32df7c4f5af1457dfa5406b3c82fb77231.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "DELETE FROM enrollment\n WHERE user_id = $1\n AND used_at IS NULL", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Int8" - ] - }, - "nullable": [] - }, - "hash": "71465915aa72eed5d35fb82149a1bd32df7c4f5af1457dfa5406b3c82fb77231" -} diff --git a/.sqlx/query-7b7092bd5fe377c8b28862721b05b3ca39aab9fb176fe970b9309d6371072e95.json b/.sqlx/query-7b7092bd5fe377c8b28862721b05b3ca39aab9fb176fe970b9309d6371072e95.json deleted file mode 100644 index d53ea77b7..000000000 --- a/.sqlx/query-7b7092bd5fe377c8b28862721b05b3ca39aab9fb176fe970b9309d6371072e95.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "DELETE FROM wireguard_peer_stats\n WHERE collected_at < $1\n AND (device_id, network, collected_at) NOT IN (\n SELECT device_id, network, MAX(collected_at)\n FROM wireguard_peer_stats\n GROUP BY device_id, network\n )", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Timestamp" - ] - }, - "nullable": [] - }, - "hash": "7b7092bd5fe377c8b28862721b05b3ca39aab9fb176fe970b9309d6371072e95" -} diff --git a/.sqlx/query-fd92ab2977c9c170e2254f13bd99fcb569ef4b44029783648b0613ca8db2a393.json b/.sqlx/query-84679835466cb41a74dd9ef281c9a69451102dae52ffb5a4df99e160a1ec8907.json similarity index 73% rename from .sqlx/query-fd92ab2977c9c170e2254f13bd99fcb569ef4b44029783648b0613ca8db2a393.json rename to .sqlx/query-84679835466cb41a74dd9ef281c9a69451102dae52ffb5a4df99e160a1ec8907.json index 900c1d364..15003141b 100644 --- a/.sqlx/query-fd92ab2977c9c170e2254f13bd99fcb569ef4b44029783648b0613ca8db2a393.json +++ b/.sqlx/query-84679835466cb41a74dd9ef281c9a69451102dae52ffb5a4df99e160a1ec8907.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT d.id \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created\n FROM device d\n JOIN wireguard_network_device wnd\n ON d.id = wnd.device_id\n WHERE wnd.wireguard_ip = $1 AND wnd.wireguard_network_id = $2", + "query": "SELECT d.id \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created FROM device d JOIN wireguard_network_device wnd ON d.id = wnd.device_id WHERE wnd.wireguard_ip = $1 AND wnd.wireguard_network_id = $2", "describe": { "columns": [ { @@ -43,5 +43,5 @@ false ] }, - "hash": "fd92ab2977c9c170e2254f13bd99fcb569ef4b44029783648b0613ca8db2a393" + "hash": "84679835466cb41a74dd9ef281c9a69451102dae52ffb5a4df99e160a1ec8907" } diff --git a/.sqlx/query-8c69910bf01556b4e35a26a4bd583d1694b8053c8522e2e6a311e1e1b4b4de15.json b/.sqlx/query-8c69910bf01556b4e35a26a4bd583d1694b8053c8522e2e6a311e1e1b4b4de15.json new file mode 100644 index 000000000..4aef0c1ba --- /dev/null +++ b/.sqlx/query-8c69910bf01556b4e35a26a4bd583d1694b8053c8522e2e6a311e1e1b4b4de15.json @@ -0,0 +1,28 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT id \"id?\", name FROM \"group\" JOIN group_user ON \"group\".id = group_user.group_id WHERE group_user.user_id = $1", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "id?", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "name", + "type_info": "Text" + } + ], + "parameters": { + "Left": [ + "Int8" + ] + }, + "nullable": [ + false, + false + ] + }, + "hash": "8c69910bf01556b4e35a26a4bd583d1694b8053c8522e2e6a311e1e1b4b4de15" +} diff --git a/.sqlx/query-9132a40b7729383ce9c108baa1b412e872ae9c96792ae9722f66ccfb24f0a144.json b/.sqlx/query-9132a40b7729383ce9c108baa1b412e872ae9c96792ae9722f66ccfb24f0a144.json new file mode 100644 index 000000000..caa6121c9 --- /dev/null +++ b/.sqlx/query-9132a40b7729383ce9c108baa1b412e872ae9c96792ae9722f66ccfb24f0a144.json @@ -0,0 +1,17 @@ +{ + "db_name": "PostgreSQL", + "query": "INSERT INTO wireguard_network_device (device_id, wireguard_network_id, wireguard_ip, is_authorized) VALUES ($1, $2, $3, $4) ON CONFLICT ON CONSTRAINT device_network DO UPDATE SET wireguard_ip = $3, is_authorized = $4", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8", + "Int8", + "Inet", + "Bool" + ] + }, + "nullable": [] + }, + "hash": "9132a40b7729383ce9c108baa1b412e872ae9c96792ae9722f66ccfb24f0a144" +} diff --git a/.sqlx/query-92c38d7487d3aa5342fbe4d059cb073400544f1ce454d059ac13b24b32cbdbf4.json b/.sqlx/query-92c38d7487d3aa5342fbe4d059cb073400544f1ce454d059ac13b24b32cbdbf4.json new file mode 100644 index 000000000..afa7cceb4 --- /dev/null +++ b/.sqlx/query-92c38d7487d3aa5342fbe4d059cb073400544f1ce454d059ac13b24b32cbdbf4.json @@ -0,0 +1,47 @@ +{ + "db_name": "PostgreSQL", + "query": "WITH stats AS ( SELECT DISTINCT ON (device_id) device_id, endpoint, latest_handshake FROM wireguard_peer_stats WHERE network = $1 ORDER BY device_id, collected_at DESC ) SELECT d.id as \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created FROM device d JOIN wireguard_network_device wnd ON wnd.device_id = d.id LEFT JOIN stats on d.id = stats.device_id WHERE wnd.wireguard_network_id = $1 AND wnd.is_authorized = true AND (stats.latest_handshake IS NULL OR (NOW() - stats.latest_handshake) > $2 * interval '1 second')", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "id?", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "name", + "type_info": "Text" + }, + { + "ordinal": 2, + "name": "wireguard_pubkey", + "type_info": "Text" + }, + { + "ordinal": 3, + "name": "user_id", + "type_info": "Int8" + }, + { + "ordinal": 4, + "name": "created", + "type_info": "Timestamp" + } + ], + "parameters": { + "Left": [ + "Int8", + "Float8" + ] + }, + "nullable": [ + false, + false, + false, + false, + false + ] + }, + "hash": "92c38d7487d3aa5342fbe4d059cb073400544f1ce454d059ac13b24b32cbdbf4" +} diff --git a/.sqlx/query-961bd7d2e2cc98e2b968ccb22e065f5c30566de00d9b96d8a70e3f08a31c9dc2.json b/.sqlx/query-961bd7d2e2cc98e2b968ccb22e065f5c30566de00d9b96d8a70e3f08a31c9dc2.json deleted file mode 100644 index 3d581539c..000000000 --- a/.sqlx/query-961bd7d2e2cc98e2b968ccb22e065f5c30566de00d9b96d8a70e3f08a31c9dc2.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n SELECT\n latest_handshake \"latest_handshake: NaiveDateTime\"\n FROM wireguard_peer_stats_view\n WHERE device_id = $1\n AND latest_handshake IS NOT NULL\n AND (latest_handshake_diff > $2 * interval '1 minute' OR latest_handshake_diff IS NULL)\n AND network = $3\n ORDER BY collected_at DESC\n LIMIT 1\n ", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "latest_handshake: NaiveDateTime", - "type_info": "Timestamp" - } - ], - "parameters": { - "Left": [ - "Int8", - "Float8", - "Int8" - ] - }, - "nullable": [ - true - ] - }, - "hash": "961bd7d2e2cc98e2b968ccb22e065f5c30566de00d9b96d8a70e3f08a31c9dc2" -} diff --git a/.sqlx/query-9838df2efdce6632793cb64bf4a118ceb4a68dad324366ed65813b05cc5ba63c.json b/.sqlx/query-9838df2efdce6632793cb64bf4a118ceb4a68dad324366ed65813b05cc5ba63c.json deleted file mode 100644 index 919eec6c3..000000000 --- a/.sqlx/query-9838df2efdce6632793cb64bf4a118ceb4a68dad324366ed65813b05cc5ba63c.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n INSERT INTO wireguard_network_allowed_group (network_id, group_id)\n SELECT $1, g.id\n FROM \"group\" g\n WHERE g.name = $2\n ", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Int8", - "Text" - ] - }, - "nullable": [] - }, - "hash": "9838df2efdce6632793cb64bf4a118ceb4a68dad324366ed65813b05cc5ba63c" -} diff --git a/.sqlx/query-9e659e4a6d973f6603f8c64ea6e7deaf8eb6824c4246d4135274e760b6af73e0.json b/.sqlx/query-9e659e4a6d973f6603f8c64ea6e7deaf8eb6824c4246d4135274e760b6af73e0.json new file mode 100644 index 000000000..7cf799593 --- /dev/null +++ b/.sqlx/query-9e659e4a6d973f6603f8c64ea6e7deaf8eb6824c4246d4135274e760b6af73e0.json @@ -0,0 +1,17 @@ +{ + "db_name": "PostgreSQL", + "query": "UPDATE wireguard_network_device SET wireguard_ip = $3, is_authorized = $4 WHERE device_id = $1 AND wireguard_network_id = $2", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8", + "Int8", + "Inet", + "Bool" + ] + }, + "nullable": [] + }, + "hash": "9e659e4a6d973f6603f8c64ea6e7deaf8eb6824c4246d4135274e760b6af73e0" +} diff --git a/.sqlx/query-a6074af430326dc14dd2b50a6d2c4217fc4f3b662028eb0c8283b85d5a279eca.json b/.sqlx/query-a6074af430326dc14dd2b50a6d2c4217fc4f3b662028eb0c8283b85d5a279eca.json new file mode 100644 index 000000000..497c65cca --- /dev/null +++ b/.sqlx/query-a6074af430326dc14dd2b50a6d2c4217fc4f3b662028eb0c8283b85d5a279eca.json @@ -0,0 +1,15 @@ +{ + "db_name": "PostgreSQL", + "query": "INSERT INTO wireguard_network_allowed_group (network_id, group_id) SELECT $1, g.id FROM \"group\" g WHERE g.name = $2", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8", + "Text" + ] + }, + "nullable": [] + }, + "hash": "a6074af430326dc14dd2b50a6d2c4217fc4f3b662028eb0c8283b85d5a279eca" +} diff --git a/.sqlx/query-aa8bbafc145ad47aaac28e9863c19b1db6a855e917cdaf619a9461ad89b96917.json b/.sqlx/query-aa8bbafc145ad47aaac28e9863c19b1db6a855e917cdaf619a9461ad89b96917.json deleted file mode 100644 index 96f0ec290..000000000 --- a/.sqlx/query-aa8bbafc145ad47aaac28e9863c19b1db6a855e917cdaf619a9461ad89b96917.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n DELETE FROM wireguard_network_device\n WHERE device_id = $1 AND wireguard_network_id = $2\n ", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Int8", - "Int8" - ] - }, - "nullable": [] - }, - "hash": "aa8bbafc145ad47aaac28e9863c19b1db6a855e917cdaf619a9461ad89b96917" -} diff --git a/.sqlx/query-ad0934b3563f5ab5ca351d0db6a2677301edffa66042632d02c9b77dd11a1e83.json b/.sqlx/query-ad0934b3563f5ab5ca351d0db6a2677301edffa66042632d02c9b77dd11a1e83.json deleted file mode 100644 index b5c9df1d1..000000000 --- a/.sqlx/query-ad0934b3563f5ab5ca351d0db6a2677301edffa66042632d02c9b77dd11a1e83.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n SELECT name\n FROM wireguard_network_allowed_group wag\n JOIN \"group\" g ON wag.group_id = g.id\n WHERE wag.network_id = $1\n ", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "name", - "type_info": "Text" - } - ], - "parameters": { - "Left": [ - "Int8" - ] - }, - "nullable": [ - false - ] - }, - "hash": "ad0934b3563f5ab5ca351d0db6a2677301edffa66042632d02c9b77dd11a1e83" -} diff --git a/.sqlx/query-c0e30b2a0b711ea77d88a6dc9c92d0faa187d2bb59bedd0c66d1eae866922901.json b/.sqlx/query-c0e30b2a0b711ea77d88a6dc9c92d0faa187d2bb59bedd0c66d1eae866922901.json deleted file mode 100644 index 768f9b53d..000000000 --- a/.sqlx/query-c0e30b2a0b711ea77d88a6dc9c92d0faa187d2bb59bedd0c66d1eae866922901.json +++ /dev/null @@ -1,59 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n WITH stats AS (\n SELECT DISTINCT ON (network) network, endpoint, latest_handshake\n FROM wireguard_peer_stats\n WHERE device_id = $2\n ORDER BY network, collected_at DESC\n )\n SELECT\n n.id as network_id, n.name as network_name, n.endpoint as gateway_endpoint,\n wnd.wireguard_ip as \"device_wireguard_ip: IpAddr\", stats.endpoint as device_endpoint,\n stats.latest_handshake as \"latest_handshake?\",\n COALESCE (((NOW() - stats.latest_handshake) < $1 * interval '1 minute'), false) as \"is_active!\"\n FROM wireguard_network_device wnd\n JOIN wireguard_network n ON n.id = wnd.wireguard_network_id\n LEFT JOIN stats on n.id = stats.network\n WHERE wnd.device_id = $2\n ", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "network_id", - "type_info": "Int8" - }, - { - "ordinal": 1, - "name": "network_name", - "type_info": "Text" - }, - { - "ordinal": 2, - "name": "gateway_endpoint", - "type_info": "Text" - }, - { - "ordinal": 3, - "name": "device_wireguard_ip: IpAddr", - "type_info": "Inet" - }, - { - "ordinal": 4, - "name": "device_endpoint", - "type_info": "Text" - }, - { - "ordinal": 5, - "name": "latest_handshake?", - "type_info": "Timestamp" - }, - { - "ordinal": 6, - "name": "is_active!", - "type_info": "Bool" - } - ], - "parameters": { - "Left": [ - "Float8", - "Int8" - ] - }, - "nullable": [ - false, - false, - false, - false, - true, - false, - null - ] - }, - "hash": "c0e30b2a0b711ea77d88a6dc9c92d0faa187d2bb59bedd0c66d1eae866922901" -} diff --git a/.sqlx/query-caf97c3a058eac0f9deb4e474b0d76a2d14a75d04f4ea5474e06adc9466a544d.json b/.sqlx/query-caf97c3a058eac0f9deb4e474b0d76a2d14a75d04f4ea5474e06adc9466a544d.json new file mode 100644 index 000000000..72c3f6bd6 --- /dev/null +++ b/.sqlx/query-caf97c3a058eac0f9deb4e474b0d76a2d14a75d04f4ea5474e06adc9466a544d.json @@ -0,0 +1,35 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT d.wireguard_pubkey as pubkey, preshared_key, array[host(wnd.wireguard_ip)] as \"allowed_ips!: Vec\" FROM wireguard_network_device wnd JOIN device d ON wnd.device_id = d.id WHERE wireguard_network_id = $1 AND (is_authorized = true OR NOT $2) ORDER BY d.id ASC", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "pubkey", + "type_info": "Text" + }, + { + "ordinal": 1, + "name": "preshared_key", + "type_info": "Text" + }, + { + "ordinal": 2, + "name": "allowed_ips!: Vec", + "type_info": "TextArray" + } + ], + "parameters": { + "Left": [ + "Int8", + "Bool" + ] + }, + "nullable": [ + false, + true, + null + ] + }, + "hash": "caf97c3a058eac0f9deb4e474b0d76a2d14a75d04f4ea5474e06adc9466a544d" +} diff --git a/.sqlx/query-2da415f5b71186fcfbe7fdf3794606eb73b47c4ec120aaef50aff6c7d075dbdd.json b/.sqlx/query-cbe6cdf1b9dd1d13bbb460726e33001ee45dea8486fb02e8c375d7b513ac0d6d.json similarity index 82% rename from .sqlx/query-2da415f5b71186fcfbe7fdf3794606eb73b47c4ec120aaef50aff6c7d075dbdd.json rename to .sqlx/query-cbe6cdf1b9dd1d13bbb460726e33001ee45dea8486fb02e8c375d7b513ac0d6d.json index 9581c1f52..26232ef8b 100644 --- a/.sqlx/query-2da415f5b71186fcfbe7fdf3794606eb73b47c4ec120aaef50aff6c7d075dbdd.json +++ b/.sqlx/query-cbe6cdf1b9dd1d13bbb460726e33001ee45dea8486fb02e8c375d7b513ac0d6d.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT id, mfa_enabled, totp_enabled, email_mfa_enabled, mfa_method as \"mfa_method: MFAMethod\", password_hash FROM \"user\"\n ", + "query": "SELECT id, mfa_enabled, totp_enabled, email_mfa_enabled, mfa_method as \"mfa_method: MFAMethod\", password_hash FROM \"user\"", "describe": { "columns": [ { @@ -59,5 +59,5 @@ true ] }, - "hash": "2da415f5b71186fcfbe7fdf3794606eb73b47c4ec120aaef50aff6c7d075dbdd" + "hash": "cbe6cdf1b9dd1d13bbb460726e33001ee45dea8486fb02e8c375d7b513ac0d6d" } diff --git a/.sqlx/query-cdda0d8e9b34aef0728fc390bf77a3211b708f23ecdb3df5cada3d628280a025.json b/.sqlx/query-cdda0d8e9b34aef0728fc390bf77a3211b708f23ecdb3df5cada3d628280a025.json deleted file mode 100644 index c17124309..000000000 --- a/.sqlx/query-cdda0d8e9b34aef0728fc390bf77a3211b708f23ecdb3df5cada3d628280a025.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n SELECT d.wireguard_pubkey as pubkey, array[host(wnd.wireguard_ip)] as \"allowed_ips!: Vec\" FROM wireguard_network_device wnd\n JOIN device d\n ON wnd.device_id = d.id\n WHERE wireguard_network_id = $1\n ORDER BY d.id ASC\n ", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "pubkey", - "type_info": "Text" - }, - { - "ordinal": 1, - "name": "allowed_ips!: Vec", - "type_info": "TextArray" - } - ], - "parameters": { - "Left": [ - "Int8" - ] - }, - "nullable": [ - false, - null - ] - }, - "hash": "cdda0d8e9b34aef0728fc390bf77a3211b708f23ecdb3df5cada3d628280a025" -} diff --git a/.sqlx/query-d3b425017872becff45f39513c9e09b3d3ba8fc86e97c7f1ff21597a884af06d.json b/.sqlx/query-d3b425017872becff45f39513c9e09b3d3ba8fc86e97c7f1ff21597a884af06d.json deleted file mode 100644 index 4c499f9f3..000000000 --- a/.sqlx/query-d3b425017872becff45f39513c9e09b3d3ba8fc86e97c7f1ff21597a884af06d.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "\n SELECT wireguard_network_id as network_id, wireguard_ip as \"device_wireguard_ip: IpAddr\"\n FROM wireguard_network_device\n WHERE device_id = $1\n ", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "network_id", - "type_info": "Int8" - }, - { - "ordinal": 1, - "name": "device_wireguard_ip: IpAddr", - "type_info": "Inet" - } - ], - "parameters": { - "Left": [ - "Int8" - ] - }, - "nullable": [ - false, - false - ] - }, - "hash": "d3b425017872becff45f39513c9e09b3d3ba8fc86e97c7f1ff21597a884af06d" -} diff --git a/.sqlx/query-ee6ed3df25517a6fedf6981166e58601de53af70dd28f69b84caca6e36cb8956.json b/.sqlx/query-ee6ed3df25517a6fedf6981166e58601de53af70dd28f69b84caca6e36cb8956.json deleted file mode 100644 index d59b060a1..000000000 --- a/.sqlx/query-ee6ed3df25517a6fedf6981166e58601de53af70dd28f69b84caca6e36cb8956.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "INSERT INTO wireguard_network_device\n (device_id, wireguard_network_id, wireguard_ip)\n VALUES ($1, $2, $3)\n ON CONFLICT ON CONSTRAINT device_network\n DO UPDATE SET wireguard_ip = $3", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Int8", - "Int8", - "Inet" - ] - }, - "nullable": [] - }, - "hash": "ee6ed3df25517a6fedf6981166e58601de53af70dd28f69b84caca6e36cb8956" -} diff --git a/.sqlx/query-efe773da199984a169b636cafabd4ee0967c7dc68a04ec930f863d8f3f34c14a.json b/.sqlx/query-efe773da199984a169b636cafabd4ee0967c7dc68a04ec930f863d8f3f34c14a.json new file mode 100644 index 000000000..408dde103 --- /dev/null +++ b/.sqlx/query-efe773da199984a169b636cafabd4ee0967c7dc68a04ec930f863d8f3f34c14a.json @@ -0,0 +1,59 @@ +{ + "db_name": "PostgreSQL", + "query": "WITH stats AS ( SELECT DISTINCT ON (network) network, endpoint, latest_handshake FROM wireguard_peer_stats WHERE device_id = $2 ORDER BY network, collected_at DESC ) SELECT n.id as network_id, n.name as network_name, n.endpoint as gateway_endpoint, wnd.wireguard_ip as \"device_wireguard_ip: IpAddr\", stats.endpoint as device_endpoint, stats.latest_handshake as \"latest_handshake?\", COALESCE (((NOW() - stats.latest_handshake) < $1 * interval '1 minute'), false) as \"is_active!\" FROM wireguard_network_device wnd JOIN wireguard_network n ON n.id = wnd.wireguard_network_id LEFT JOIN stats on n.id = stats.network WHERE wnd.device_id = $2", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "network_id", + "type_info": "Int8" + }, + { + "ordinal": 1, + "name": "network_name", + "type_info": "Text" + }, + { + "ordinal": 2, + "name": "gateway_endpoint", + "type_info": "Text" + }, + { + "ordinal": 3, + "name": "device_wireguard_ip: IpAddr", + "type_info": "Inet" + }, + { + "ordinal": 4, + "name": "device_endpoint", + "type_info": "Text" + }, + { + "ordinal": 5, + "name": "latest_handshake?", + "type_info": "Timestamp" + }, + { + "ordinal": 6, + "name": "is_active!", + "type_info": "Bool" + } + ], + "parameters": { + "Left": [ + "Float8", + "Int8" + ] + }, + "nullable": [ + false, + false, + false, + false, + true, + false, + null + ] + }, + "hash": "efe773da199984a169b636cafabd4ee0967c7dc68a04ec930f863d8f3f34c14a" +} diff --git a/.sqlx/query-effe03b1e22929191b7d07e51586153215f982b9c8e43f68ebb62597df31d8f8.json b/.sqlx/query-effe03b1e22929191b7d07e51586153215f982b9c8e43f68ebb62597df31d8f8.json deleted file mode 100644 index 40aebf630..000000000 --- a/.sqlx/query-effe03b1e22929191b7d07e51586153215f982b9c8e43f68ebb62597df31d8f8.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "INSERT INTO enrollment (id, user_id, admin_id, email, created_at, expires_at, used_at) VALUES ($1, $2, $3, $4, $5, $6, $7)", - "describe": { - "columns": [], - "parameters": { - "Left": [ - "Text", - "Int8", - "Int8", - "Text", - "Timestamp", - "Timestamp", - "Timestamp" - ] - }, - "nullable": [] - }, - "hash": "effe03b1e22929191b7d07e51586153215f982b9c8e43f68ebb62597df31d8f8" -} diff --git a/.sqlx/query-e19b29d2e52ad2a2a5c20ce205d5c949d02219fd252d78f7fffa202cc804b4c2.json b/.sqlx/query-f222309aff56e5182091655c0a6c34cddfee21a48f981c3ca22a6e064c18a769.json similarity index 62% rename from .sqlx/query-e19b29d2e52ad2a2a5c20ce205d5c949d02219fd252d78f7fffa202cc804b4c2.json rename to .sqlx/query-f222309aff56e5182091655c0a6c34cddfee21a48f981c3ca22a6e064c18a769.json index e1fe0b4b9..25ae273d7 100644 --- a/.sqlx/query-e19b29d2e52ad2a2a5c20ce205d5c949d02219fd252d78f7fffa202cc804b4c2.json +++ b/.sqlx/query-f222309aff56e5182091655c0a6c34cddfee21a48f981c3ca22a6e064c18a769.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "INSERT INTO \"wireguard_network\" (\"name\",\"address\",\"port\",\"pubkey\",\"prvkey\",\"endpoint\",\"dns\",\"allowed_ips\",\"connected_at\") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9) RETURNING id", + "query": "INSERT INTO \"wireguard_network\" (\"name\",\"address\",\"port\",\"pubkey\",\"prvkey\",\"endpoint\",\"dns\",\"allowed_ips\",\"connected_at\",\"mfa_enabled\",\"keepalive_interval\",\"peer_disconnect_threshold\") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) RETURNING id", "describe": { "columns": [ { @@ -19,12 +19,15 @@ "Text", "Text", "InetArray", - "Timestamp" + "Timestamp", + "Bool", + "Int4", + "Int4" ] }, "nullable": [ false ] }, - "hash": "e19b29d2e52ad2a2a5c20ce205d5c949d02219fd252d78f7fffa202cc804b4c2" + "hash": "f222309aff56e5182091655c0a6c34cddfee21a48f981c3ca22a6e064c18a769" } diff --git a/.sqlx/query-f2c353b073b98ba636f9fbde139c2be9ba6f3cda184e0ee772cf900f8f110bd8.json b/.sqlx/query-f2c353b073b98ba636f9fbde139c2be9ba6f3cda184e0ee772cf900f8f110bd8.json new file mode 100644 index 000000000..f0fca8cb4 --- /dev/null +++ b/.sqlx/query-f2c353b073b98ba636f9fbde139c2be9ba6f3cda184e0ee772cf900f8f110bd8.json @@ -0,0 +1,15 @@ +{ + "db_name": "PostgreSQL", + "query": "DELETE FROM wireguard_network_allowed_group WHERE network_id = $1 AND group_id IN ( SELECT id FROM \"group\" WHERE name IN (SELECT * FROM UNNEST($2::text[])) )", + "describe": { + "columns": [], + "parameters": { + "Left": [ + "Int8", + "TextArray" + ] + }, + "nullable": [] + }, + "hash": "f2c353b073b98ba636f9fbde139c2be9ba6f3cda184e0ee772cf900f8f110bd8" +} diff --git a/.sqlx/query-49749227cacd46dd9a392d58233a511ee03c0df12cb28ce247d574923fee31a9.json b/.sqlx/query-f6cb6d9cdf5db43582cdb77f3c60335ae28f92e6653abcfd001118a965cb5d36.json similarity index 79% rename from .sqlx/query-49749227cacd46dd9a392d58233a511ee03c0df12cb28ce247d574923fee31a9.json rename to .sqlx/query-f6cb6d9cdf5db43582cdb77f3c60335ae28f92e6653abcfd001118a965cb5d36.json index 2ac3ac936..b115ecb03 100644 --- a/.sqlx/query-49749227cacd46dd9a392d58233a511ee03c0df12cb28ce247d574923fee31a9.json +++ b/.sqlx/query-f6cb6d9cdf5db43582cdb77f3c60335ae28f92e6653abcfd001118a965cb5d36.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at FROM enrollment", + "query": "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at, token_type FROM token", "describe": { "columns": [ { @@ -37,6 +37,11 @@ "ordinal": 6, "name": "used_at", "type_info": "Timestamp" + }, + { + "ordinal": 7, + "name": "token_type", + "type_info": "Text" } ], "parameters": { @@ -45,12 +50,13 @@ "nullable": [ false, false, - false, + true, true, false, false, + true, true ] }, - "hash": "49749227cacd46dd9a392d58233a511ee03c0df12cb28ce247d574923fee31a9" + "hash": "f6cb6d9cdf5db43582cdb77f3c60335ae28f92e6653abcfd001118a965cb5d36" } diff --git a/.sqlx/query-0b53e81d6f1ce3c3a68c871e7a4b9e41db58b112d12281516e10421d46fbbd94.json b/.sqlx/query-fdbb9308a58ade3fd1cba272fe3979ed4bafb1ee079fd8b23ac9c2ef95db2312.json similarity index 59% rename from .sqlx/query-0b53e81d6f1ce3c3a68c871e7a4b9e41db58b112d12281516e10421d46fbbd94.json rename to .sqlx/query-fdbb9308a58ade3fd1cba272fe3979ed4bafb1ee079fd8b23ac9c2ef95db2312.json index 828f2523d..dd54ba7fc 100644 --- a/.sqlx/query-0b53e81d6f1ce3c3a68c871e7a4b9e41db58b112d12281516e10421d46fbbd94.json +++ b/.sqlx/query-fdbb9308a58ade3fd1cba272fe3979ed4bafb1ee079fd8b23ac9c2ef95db2312.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "\n SELECT DISTINCT ON (d.id) d.id as \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created\n FROM device d\n JOIN \"user\" u ON d.user_id = u.id\n JOIN group_user gu ON u.id = gu.user_id\n JOIN \"group\" g ON gu.group_id = g.id\n WHERE g.\"name\" IN (SELECT * FROM UNNEST($1::text[]))\n ORDER BY d.id ASC\n ", + "query": "SELECT DISTINCT ON (d.id) d.id as \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created FROM device d JOIN \"user\" u ON d.user_id = u.id JOIN group_user gu ON u.id = gu.user_id JOIN \"group\" g ON gu.group_id = g.id WHERE g.\"name\" IN (SELECT * FROM UNNEST($1::text[]))\n ORDER BY d.id ASC", "describe": { "columns": [ { @@ -42,5 +42,5 @@ false ] }, - "hash": "0b53e81d6f1ce3c3a68c871e7a4b9e41db58b112d12281516e10421d46fbbd94" + "hash": "fdbb9308a58ade3fd1cba272fe3979ed4bafb1ee079fd8b23ac9c2ef95db2312" } diff --git a/.sqlx/query-18e96b44b04c6ed00424ac497889e5952c877f1d14216f5b083fd7fa7c927bb7.json b/.sqlx/query-ff9f1363df5b9dc633767b0d3addedea0baba7447d4557f681f26c666a2c47bc.json similarity index 57% rename from .sqlx/query-18e96b44b04c6ed00424ac497889e5952c877f1d14216f5b083fd7fa7c927bb7.json rename to .sqlx/query-ff9f1363df5b9dc633767b0d3addedea0baba7447d4557f681f26c666a2c47bc.json index 210810108..b4ff83fef 100644 --- a/.sqlx/query-18e96b44b04c6ed00424ac497889e5952c877f1d14216f5b083fd7fa7c927bb7.json +++ b/.sqlx/query-ff9f1363df5b9dc633767b0d3addedea0baba7447d4557f681f26c666a2c47bc.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\" FROM\n wireguard_network_device\n WHERE wireguard_network_id = $1", + "query": "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\", preshared_key, is_authorized FROM wireguard_network_device WHERE wireguard_network_id = $1", "describe": { "columns": [ { @@ -17,6 +17,16 @@ "ordinal": 2, "name": "wireguard_ip: IpAddr", "type_info": "Inet" + }, + { + "ordinal": 3, + "name": "preshared_key", + "type_info": "Text" + }, + { + "ordinal": 4, + "name": "is_authorized", + "type_info": "Bool" } ], "parameters": { @@ -27,8 +37,10 @@ "nullable": [ false, false, + false, + true, false ] }, - "hash": "18e96b44b04c6ed00424ac497889e5952c877f1d14216f5b083fd7fa7c927bb7" + "hash": "ff9f1363df5b9dc633767b0d3addedea0baba7447d4557f681f26c666a2c47bc" } diff --git a/Cargo.lock b/Cargo.lock index db6259ecc..6f23b1d33 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -54,9 +54,9 @@ dependencies = [ [[package]] name = "ahash" -version = "0.8.6" +version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a" +checksum = "77c3a9648d43b9cd48db467b3f87fdd6e146bcc88ab0180006cef2179fe11d01" dependencies = [ "cfg-if", "getrandom", @@ -97,9 +97,9 @@ dependencies = [ [[package]] name = "anstream" -version = "0.6.4" +version = "0.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2ab91ebe16eb252986481c5b62f6098f3b698a45e34b5b98200cf20dd2484a44" +checksum = "4cd2405b3ac1faab2990b74d728624cd9fd115651fcecc7c2d8daf01376275ba" dependencies = [ "anstyle", "anstyle-parse", @@ -126,9 +126,9 @@ dependencies = [ [[package]] name = "anstyle-query" -version = "1.0.1" +version = "1.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a3a318f1f38d2418400f8209655bfd825785afd25aa30bb7ba6cc792e4596748" +checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648" dependencies = [ "windows-sys 0.52.0", ] @@ -145,9 +145,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.75" +version = "1.0.79" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6" +checksum = "080e9890a082662b09c1ad45f567faeeb47f22b5fb23895fbe1e651e718e25ca" [[package]] name = "argon2" @@ -225,18 +225,18 @@ checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] name = "async-trait" -version = "0.1.74" +version = "0.1.77" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a66537f1bb974b254c98ed142ff995236e81b9d0fe4db0575f46612cb15eb0f9" +checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -283,14 +283,42 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3b829e4e32b91e643de6eafe82b1d90675f5874230191a4ffbc1b336dec4d6bf" dependencies = [ "async-trait", - "axum-core", + "axum-core 0.3.4", "bitflags 1.3.2", "bytes", "futures-util", - "headers", - "http", - "http-body", - "hyper", + "http 0.2.11", + "http-body 0.4.6", + "hyper 0.14.28", + "itoa", + "matchit", + "memchr", + "mime", + "percent-encoding", + "pin-project-lite", + "rustversion", + "serde", + "sync_wrapper", + "tower", + "tower-layer", + "tower-service", +] + +[[package]] +name = "axum" +version = "0.7.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1236b4b292f6c4d6dc34604bb5120d85c3fe1d1aa596bd5cc52ca054d13e7b9e" +dependencies = [ + "async-trait", + "axum-core 0.4.3", + "bytes", + "futures-util", + "http 1.0.0", + "http-body 1.0.0", + "http-body-util", + "hyper 1.1.0", + "hyper-util", "itoa", "matchit", "memchr", @@ -307,15 +335,16 @@ dependencies = [ "tower", "tower-layer", "tower-service", + "tracing", ] [[package]] name = "axum-client-ip" -version = "0.4.2" +version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ef117890a418b7832678d9ea1e1c08456dd7b2fd1dadb9676cd6f0fe7eb4b21" +checksum = "0f5ffe4637708b326c621d5494ab6c91dcf62ee440fa6ee967d289315a9c6f81" dependencies = [ - "axum", + "axum 0.7.4", "forwarded-header-value", "serde", ] @@ -329,10 +358,54 @@ dependencies = [ "async-trait", "bytes", "futures-util", - "http", - "http-body", + "http 0.2.11", + "http-body 0.4.6", + "mime", + "rustversion", + "tower-layer", + "tower-service", +] + +[[package]] +name = "axum-core" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a15c63fd72d41492dc4f497196f5da1fb04fb7529e631d73630d1b491e47a2e3" +dependencies = [ + "async-trait", + "bytes", + "futures-util", + "http 1.0.0", + "http-body 1.0.0", + "http-body-util", "mime", + "pin-project-lite", "rustversion", + "sync_wrapper", + "tower-layer", + "tower-service", + "tracing", +] + +[[package]] +name = "axum-extra" +version = "0.9.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "895ff42f72016617773af68fb90da2a9677d89c62338ec09162d4909d86fdd8f" +dependencies = [ + "axum 0.7.4", + "axum-core 0.4.3", + "bytes", + "cookie 0.18.0", + "futures-util", + "headers", + "http 1.0.0", + "http-body 1.0.0", + "http-body-util", + "mime", + "pin-project-lite", + "serde", + "tower", "tower-layer", "tower-service", ] @@ -372,9 +445,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8" [[package]] name = "base64" -version = "0.21.5" +version = "0.21.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9" +checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" [[package]] name = "base64ct" @@ -388,20 +461,11 @@ version = "0.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "18b3d30abb74120a9d5267463b9e0045fdccc4dd152e7249d966612dc1721384" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "serde", "serde_json", ] -[[package]] -name = "bincode" -version = "1.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad" -dependencies = [ - "serde", -] - [[package]] name = "bitflags" version = "1.3.2" @@ -449,9 +513,9 @@ dependencies = [ [[package]] name = "bstr" -version = "1.8.0" +version = "1.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "542f33a8835a0884b006a0c3df3dadd99c0c3f296ed26c2fdc8028e01ad6230c" +checksum = "c48f0051a4b4c5e0b6d365cd04af53aeaa209e3cc15ec2cdb69e73cc87fbd0dc" dependencies = [ "memchr", "serde", @@ -516,9 +580,9 @@ dependencies = [ [[package]] name = "chrono-tz" -version = "0.8.4" +version = "0.8.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e23185c0e21df6ed832a12e2bda87c7d1def6842881fb634a8511ced741b0d76" +checksum = "91d7b79e99bfaa0d47da0687c43aa3b7381938a62ad3a6498599039321f660b7" dependencies = [ "chrono", "chrono-tz-build", @@ -567,9 +631,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.4.11" +version = "4.4.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bfaff671f6b22ca62406885ece523383b9b64022e341e53e009a62ebc47a45f2" +checksum = "80932e03c33999b9235edb8655bc9df3204adc9887c2f95b50cb1deb9fd54253" dependencies = [ "clap_builder", "clap_derive", @@ -577,9 +641,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.4.11" +version = "4.4.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a216b506622bb1d316cd51328dce24e07bdff4a6128a47c7e7fad11878d5adbb" +checksum = "d6c0db58c659eef1c73e444d298c27322a1b52f6927d2ad470c0c0f96fa7b8fa" dependencies = [ "anstream", "anstyle", @@ -596,7 +660,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -643,9 +707,9 @@ dependencies = [ [[package]] name = "const-oid" -version = "0.9.5" +version = "0.9.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f" +checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" [[package]] name = "const-random" @@ -686,17 +750,14 @@ dependencies = [ [[package]] name = "cookie" -version = "0.17.0" +version = "0.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7efb37c3e1ccb1ff97164ad95ac1606e8ccd35b3fa0a7d99a304c7f4a428cc24" +checksum = "3cd91cf61412820176e137621345ee43b3f4423e589e7ae4e50d601d93e35ef8" dependencies = [ "aes-gcm", - "base64 0.21.5", - "hkdf", - "hmac", + "base64 0.21.7", "percent-encoding", "rand", - "sha2", "subtle", "time", "version_check", @@ -737,9 +798,9 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f" [[package]] name = "cpufeatures" -version = "0.2.11" +version = "0.2.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0" +checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504" dependencies = [ "libc", ] @@ -770,46 +831,37 @@ dependencies = [ [[package]] name = "crossbeam-deque" -version = "0.8.3" +version = "0.8.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef" +checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d" dependencies = [ - "cfg-if", "crossbeam-epoch", "crossbeam-utils", ] [[package]] name = "crossbeam-epoch" -version = "0.9.15" +version = "0.9.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7" +checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" dependencies = [ - "autocfg", - "cfg-if", "crossbeam-utils", - "memoffset", - "scopeguard", ] [[package]] name = "crossbeam-queue" -version = "0.3.8" +version = "0.3.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add" +checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35" dependencies = [ - "cfg-if", "crossbeam-utils", ] [[package]] name = "crossbeam-utils" -version = "0.8.16" +version = "0.8.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294" -dependencies = [ - "cfg-if", -] +checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345" [[package]] name = "crunchy" @@ -874,7 +926,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -898,7 +950,7 @@ dependencies = [ "proc-macro2", "quote", "strsim", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -909,7 +961,7 @@ checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5" dependencies = [ "darling_core", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -920,14 +972,14 @@ checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5" [[package]] name = "defguard" -version = "0.8.0" +version = "0.9.0" dependencies = [ "anyhow", "argon2", - "axum", + "axum 0.7.4", "axum-client-ip", - "base64 0.21.5", - "bincode", + "axum-extra", + "base64 0.21.7", "bytes", "chrono", "claims", @@ -965,12 +1017,12 @@ dependencies = [ "struct-patch", "tera", "thiserror", + "time", "tiny-keccak", "tokio", "tokio-stream", "tonic", "tonic-build", - "tower-cookies", "tower-http", "tracing", "tracing-subscriber", @@ -1009,9 +1061,9 @@ dependencies = [ [[package]] name = "deranged" -version = "0.3.10" +version = "0.3.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8eb30d70a07a3b04884d2677f06bec33509dc67ca60d92949e5535352d3191dc" +checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4" dependencies = [ "powerfmt", "serde", @@ -1032,9 +1084,9 @@ dependencies = [ [[package]] name = "deunicode" -version = "1.4.1" +version = "1.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a1abaf4d861455be59f64fd2b55606cb151fce304ede7165f410243ce96bde6" +checksum = "3ae2a35373c5c74340b79ae6780b498b2b183915ec5dacf263aac5a099bf485a" [[package]] name = "digest" @@ -1056,7 +1108,7 @@ checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -1154,7 +1206,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dbfb21b9878cf7a348dcb8559109aabc0ec40d69924bd706fa5149846c4fef75" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "memchr", ] @@ -1250,9 +1302,9 @@ dependencies = [ [[package]] name = "ethers-core" -version = "2.0.11" +version = "2.0.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f03e0bdc216eeb9e355b90cf610ef6c5bb8aca631f97b5ae9980ce34ea7878d" +checksum = "918b1a9ba585ea61022647def2f27c29ba19f6d2a4a4c8f68a9ae97fd5769737" dependencies = [ "arrayvec", "bytes", @@ -1396,9 +1448,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c" [[package]] name = "futures" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da0290714b38af9b4a7b094b8a37086d1b4e61f2df9122c3cad2577669145335" +checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0" dependencies = [ "futures-channel", "futures-core", @@ -1411,9 +1463,9 @@ dependencies = [ [[package]] name = "futures-channel" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff4dd66668b557604244583e3e1e1eada8c5c2e96a6d0d6653ede395b78bbacb" +checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78" dependencies = [ "futures-core", "futures-sink", @@ -1421,15 +1473,15 @@ dependencies = [ [[package]] name = "futures-core" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c" +checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d" [[package]] name = "futures-executor" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0f4fb8693db0cf099eadcca0efe2a5a22e4550f98ed16aba6c48700da29597bc" +checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d" dependencies = [ "futures-core", "futures-task", @@ -1449,38 +1501,38 @@ dependencies = [ [[package]] name = "futures-io" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa" +checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1" [[package]] name = "futures-macro" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53b153fd91e4b0147f4aced87be237c98248656bb01050b96bf3ee89220a8ddb" +checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] name = "futures-sink" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e36d3378ee38c2a36ad710c5d30c2911d752cb941c00c72dbabfb786a7970817" +checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5" [[package]] name = "futures-task" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2" +checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004" [[package]] name = "futures-util" -version = "0.3.29" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a19526d624e703a3179b3d322efec918b6246ea0fa51d41124525f00f1cc8104" +checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48" dependencies = [ "futures-channel", "futures-core", @@ -1516,9 +1568,9 @@ dependencies = [ [[package]] name = "getrandom" -version = "0.2.11" +version = "0.2.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f" +checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5" dependencies = [ "cfg-if", "js-sys", @@ -1580,16 +1632,35 @@ dependencies = [ [[package]] name = "h2" -version = "0.3.22" +version = "0.3.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b553656127a00601c8ae5590fcfdc118e4083a7924b6cf4ffc1ea4b99dc429d7" +dependencies = [ + "bytes", + "fnv", + "futures-core", + "futures-sink", + "futures-util", + "http 0.2.11", + "indexmap 2.1.0", + "slab", + "tokio", + "tokio-util", + "tracing", +] + +[[package]] +name = "h2" +version = "0.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4d6250322ef6e60f93f9a2162799302cd6f68f79f6e5d85c8c16f14d1d958178" +checksum = "991910e35c615d8cab86b5ab04be67e6ad24d2bf5f4f11fdbbed26da999bbeab" dependencies = [ "bytes", "fnv", "futures-core", "futures-sink", "futures-util", - "http", + "http 1.0.0", "indexmap 2.1.0", "slab", "tokio", @@ -1630,14 +1701,14 @@ dependencies = [ [[package]] name = "headers" -version = "0.3.9" +version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270" +checksum = "322106e6bd0cba2d5ead589ddb8150a13d7c4217cf80d7c4f682ca994ccc6aa9" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "bytes", "headers-core", - "http", + "http 1.0.0", "httpdate", "mime", "sha1", @@ -1645,11 +1716,11 @@ dependencies = [ [[package]] name = "headers-core" -version = "0.2.0" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429" +checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4" dependencies = [ - "http", + "http 1.0.0", ] [[package]] @@ -1675,9 +1746,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" [[package]] name = "hkdf" -version = "0.12.3" +version = "0.12.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437" +checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" dependencies = [ "hmac", ] @@ -1693,11 +1764,11 @@ dependencies = [ [[package]] name = "home" -version = "0.5.5" +version = "0.5.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb" +checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.52.0", ] [[package]] @@ -1722,22 +1793,56 @@ dependencies = [ "itoa", ] +[[package]] +name = "http" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b32afd38673a8016f7c9ae69e5af41a58f81b1d31689040f2f1959594ce194ea" +dependencies = [ + "bytes", + "fnv", + "itoa", +] + [[package]] name = "http-body" -version = "0.4.5" +version = "0.4.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1" +checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2" dependencies = [ "bytes", - "http", + "http 0.2.11", + "pin-project-lite", +] + +[[package]] +name = "http-body" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643" +dependencies = [ + "bytes", + "http 1.0.0", +] + +[[package]] +name = "http-body-util" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41cb79eb393015dadd30fc252023adb0b2400a0caee0fa2a077e6e21a551e840" +dependencies = [ + "bytes", + "futures-util", + "http 1.0.0", + "http-body 1.0.0", "pin-project-lite", ] [[package]] name = "http-range-header" -version = "0.3.1" +version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "add0ab9360ddbd88cfeb3bd9574a1d85cfdfa14db10b3e21d3700dbc4328758f" +checksum = "3ce4ef31cda248bbdb6e6820603b82dfcd9e833db65a43e997a0ccec777d11fe" [[package]] name = "httparse" @@ -1768,28 +1873,47 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4" [[package]] name = "hyper" -version = "0.14.27" +version = "0.14.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468" +checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80" dependencies = [ "bytes", "futures-channel", "futures-core", "futures-util", - "h2", - "http", - "http-body", + "h2 0.3.23", + "http 0.2.11", + "http-body 0.4.6", "httparse", "httpdate", "itoa", "pin-project-lite", - "socket2 0.4.10", + "socket2", "tokio", "tower-service", "tracing", "want", ] +[[package]] +name = "hyper" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fb5aa53871fc917b1a9ed87b683a5d86db645e23acb32c2e0785a353e522fb75" +dependencies = [ + "bytes", + "futures-channel", + "futures-util", + "h2 0.4.1", + "http 1.0.0", + "http-body 1.0.0", + "httparse", + "httpdate", + "itoa", + "pin-project-lite", + "tokio", +] + [[package]] name = "hyper-rustls" version = "0.24.2" @@ -1797,8 +1921,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590" dependencies = [ "futures-util", - "http", - "hyper", + "http 0.2.11", + "hyper 0.14.28", "rustls", "tokio", "tokio-rustls", @@ -1810,7 +1934,7 @@ version = "0.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbb958482e8c7be4bc3cf272a766a2b0bf1a6755e7a6ae777f017a31d11b13b1" dependencies = [ - "hyper", + "hyper 0.14.28", "pin-project-lite", "tokio", "tokio-io-timeout", @@ -1823,17 +1947,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905" dependencies = [ "bytes", - "hyper", + "hyper 0.14.28", "native-tls", "tokio", "tokio-native-tls", ] +[[package]] +name = "hyper-util" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bdea9aac0dbe5a9240d68cfd9501e2db94222c6dc06843e06640b9e07f0fdc67" +dependencies = [ + "bytes", + "futures-channel", + "futures-util", + "http 1.0.0", + "http-body 1.0.0", + "hyper 1.1.0", + "pin-project-lite", + "socket2", + "tokio", + "tracing", +] + [[package]] name = "iana-time-zone" -version = "0.1.58" +version = "0.1.59" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8326b86b6cff230b97d0d312a6c40a60726df3332e721f72a1b035f451663b20" +checksum = "b6a67363e2aa4443928ce15e57ebae94fd8949958fd1223c4cfc0cd473ad7539" dependencies = [ "android_system_properties", "core-foundation-sys", @@ -1891,9 +2033,9 @@ dependencies = [ [[package]] name = "ignore" -version = "0.4.21" +version = "0.4.22" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "747ad1b4ae841a78e8aba0d63adbfbeaea26b517b63705d47856b73015d27060" +checksum = "b46810df39e66e925525d6e38ce1e7f6e1d208f72dc39757880fcb66e2c58af1" dependencies = [ "crossbeam-deque", "globset", @@ -2007,17 +2149,26 @@ dependencies = [ "either", ] +[[package]] +name = "itertools" +version = "0.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "25db6b064527c5d482d0423354fcd07a89a2dfe07b67892e62411946db7f07b0" +dependencies = [ + "either", +] + [[package]] name = "itoa" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38" +checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c" [[package]] name = "js-sys" -version = "0.3.66" +version = "0.3.67" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cee9c64da59eae3b50095c18d3e74f8b73c0b86d2792824ff01bbce68ba229ca" +checksum = "9a1d36f1235bc969acba30b7f5990b864423a6068a10f7c90ae8f0112e3a59d1" dependencies = [ "wasm-bindgen", ] @@ -2028,10 +2179,10 @@ version = "9.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5c7ea04a7c5c055c175f189b6dc6ba036fd62306b58c66c9f6389036c503a3f4" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "js-sys", "pem", - "ring 0.17.6", + "ring 0.17.7", "serde", "serde_json", "simple_asn1", @@ -2039,9 +2190,9 @@ dependencies = [ [[package]] name = "k256" -version = "0.13.2" +version = "0.13.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f01b677d82ef7a676aa37e099defd83a28e15687112cafdd112d60236b6115b" +checksum = "956ff9b67e26e1a6a866cb758f12c6f8746208489e3e4a4b5580802f2f0a587b" dependencies = [ "cfg-if", "ecdsa", @@ -2052,9 +2203,9 @@ dependencies = [ [[package]] name = "keccak" -version = "0.1.4" +version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f6d5ed8676d904364de097082f4e7d240b571b67989ced0240f08b7f966f940" +checksum = "ecc2af9a1119c51f12a14607e783cb977bde58bc069ff0c3da1095e635d70654" dependencies = [ "cpufeatures", ] @@ -2104,12 +2255,12 @@ dependencies = [ [[package]] name = "lettre" -version = "0.11.2" +version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a48c2e9831b370bc2d7233c2620298c45f3a158ed6b4b8d7416b2ada5a268fd8" +checksum = "f5aaf628956b6b0852e12ac3505d20d7a12ecc1e32d5ea921f002af4a74036a5" dependencies = [ "async-trait", - "base64 0.21.5", + "base64 0.21.7", "chumsky", "email-encoding", "email_address", @@ -2122,9 +2273,8 @@ dependencies = [ "mime", "native-tls", "nom", - "once_cell", "quoted_printable", - "socket2 0.5.5", + "socket2", "tokio", "tokio-native-tls", "url", @@ -2132,9 +2282,9 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.150" +version = "0.2.152" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c" +checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7" [[package]] name = "libm" @@ -2229,18 +2379,9 @@ dependencies = [ [[package]] name = "memchr" -version = "2.6.4" +version = "2.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167" - -[[package]] -name = "memoffset" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c" -dependencies = [ - "autocfg", -] +checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149" [[package]] name = "mime" @@ -2275,9 +2416,9 @@ dependencies = [ [[package]] name = "mio" -version = "0.8.9" +version = "0.8.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3dce281c5e46beae905d4de1870d8b1509a9142b62eedf18b443b011ca8343d0" +checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09" dependencies = [ "libc", "wasi", @@ -2289,7 +2430,7 @@ name = "model_derive" version = "0.1.2" dependencies = [ "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -2424,23 +2565,23 @@ dependencies = [ [[package]] name = "num_enum" -version = "0.7.1" +version = "0.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "683751d591e6d81200c39fb0d1032608b77724f34114db54f571ff1317b337c0" +checksum = "02339744ee7253741199f897151b38e72257d13802d4ee837285cc2990a90845" dependencies = [ "num_enum_derive", ] [[package]] name = "num_enum_derive" -version = "0.7.1" +version = "0.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c11e44798ad209ccdd91fc192f0526a369a01234f7373e1b141c96d7cee4f0e" +checksum = "681030a937600a36906c185595136d26abfebb4aa9c65701cefcaf8578bb982b" dependencies = [ - "proc-macro-crate 2.0.0", + "proc-macro-crate 3.0.0", "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -2452,7 +2593,7 @@ dependencies = [ "base64 0.13.1", "chrono", "getrandom", - "http", + "http 0.2.11", "rand", "serde", "serde_json", @@ -2464,9 +2605,9 @@ dependencies = [ [[package]] name = "object" -version = "0.32.1" +version = "0.32.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0" +checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441" dependencies = [ "memchr", ] @@ -2482,9 +2623,9 @@ dependencies = [ [[package]] name = "once_cell" -version = "1.18.0" +version = "1.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d" +checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92" [[package]] name = "opaque-debug" @@ -2528,7 +2669,7 @@ dependencies = [ "dyn-clone", "ed25519-dalek", "hmac", - "http", + "http 0.2.11", "itertools 0.10.5", "log", "oauth2", @@ -2551,9 +2692,9 @@ dependencies = [ [[package]] name = "openssl" -version = "0.10.61" +version = "0.10.62" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b8419dc8cc6d866deb801274bba2e6f8f6108c1bb7fcc10ee5ab864931dbb45" +checksum = "8cde4d2d9200ad5909f8dac647e29482e07c3a35de8a13fce7c9c7747ad9f671" dependencies = [ "bitflags 2.4.1", "cfg-if", @@ -2572,7 +2713,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -2583,9 +2724,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf" [[package]] name = "openssl-sys" -version = "0.9.97" +version = "0.9.98" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3eaad34cdd97d81de97964fc7f29e2d104f483840d906ef56daa1912338460b" +checksum = "c1665caf8ab2dc9aef43d1c0023bd904633a6a05cb30b0ad59bec2ae986e57a7" dependencies = [ "cc", "libc", @@ -2730,11 +2871,11 @@ checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c" [[package]] name = "pem" -version = "3.0.2" +version = "3.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3163d2912b7c3b52d651a055f2c7eec9ba5cd22d26ef75b8dd3a59980b185923" +checksum = "1b8fcc794035347fb64beda2d3b462595dd2753e3f268d89c5aae77e8cf2c310" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "serde", ] @@ -2755,9 +2896,9 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e" [[package]] name = "pest" -version = "2.7.5" +version = "2.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae9cee2a55a544be8b89dc6848072af97a20f2422603c10865be2a42b580fff5" +checksum = "1f200d8d83c44a45b21764d1916299752ca035d15ecd46faca3e9a2a2bf6ad06" dependencies = [ "memchr", "thiserror", @@ -2766,9 +2907,9 @@ dependencies = [ [[package]] name = "pest_derive" -version = "2.7.5" +version = "2.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "81d78524685f5ef2a3b3bd1cafbc9fcabb036253d9b1463e726a91cd16e2dfc2" +checksum = "bcd6ab1236bbdb3a49027e920e693192ebfe8913f6d60e294de57463a493cfde" dependencies = [ "pest", "pest_generator", @@ -2776,22 +2917,22 @@ dependencies = [ [[package]] name = "pest_generator" -version = "2.7.5" +version = "2.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "68bd1206e71118b5356dae5ddc61c8b11e28b09ef6a31acbd15ea48a28e0c227" +checksum = "2a31940305ffc96863a735bef7c7994a00b325a7138fdbc5bda0f1a0476d3275" dependencies = [ "pest", "pest_meta", "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] name = "pest_meta" -version = "2.7.5" +version = "2.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c747191d4ad9e4a4ab9c8798f1e82a39affe7ef9648390b7e5548d18e099de6" +checksum = "a7ff62f5259e53b78d1af898941cdcdccfae7385cf7d793a6e55de5d05bb4b7d" dependencies = [ "once_cell", "pest", @@ -2863,7 +3004,7 @@ checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -2901,15 +3042,15 @@ dependencies = [ [[package]] name = "pkg-config" -version = "0.3.27" +version = "0.3.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964" +checksum = "69d3587f8a9e599cc7ec2c00e331f71c4e69a5f9a4b8a6efd5b07466b9736f9a" [[package]] name = "platforms" -version = "3.2.0" +version = "3.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "14e6ab3f592e6fb464fc9712d8d6e6912de6473954635fd76a589d832cffcbb0" +checksum = "626dec3cac7cc0e1577a2ec3fc496277ec2baa084bebad95bb6fdbfae235f84c" [[package]] name = "polyval" @@ -2937,12 +3078,12 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de" [[package]] name = "prettyplease" -version = "0.2.15" +version = "0.2.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae005bd773ab59b4725093fd7df83fd7892f7d8eafb48dbd7de6e024e4215f9d" +checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5" dependencies = [ "proc-macro2", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -2987,6 +3128,15 @@ dependencies = [ "toml_edit 0.20.7", ] +[[package]] +name = "proc-macro-crate" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6b2685dd208a3771337d8d386a89840f0f43cd68be8dae90a5f8c2384effc9cd" +dependencies = [ + "toml_edit 0.21.0", +] + [[package]] name = "proc-macro-error" version = "1.0.4" @@ -3013,9 +3163,9 @@ dependencies = [ [[package]] name = "proc-macro2" -version = "1.0.70" +version = "1.0.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b" +checksum = "95fc56cda0b5c3325f5fbbd7ff9fda9e02bb00bb3dac51252d2f1bfa1cb8cc8c" dependencies = [ "unicode-ident", ] @@ -3063,7 +3213,7 @@ dependencies = [ "prost", "prost-types", "regex", - "syn 2.0.39", + "syn 2.0.48", "tempfile", "which", ] @@ -3078,7 +3228,7 @@ dependencies = [ "itertools 0.11.0", "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -3129,9 +3279,9 @@ dependencies = [ [[package]] name = "quote" -version = "1.0.33" +version = "1.0.35" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae" +checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef" dependencies = [ "proc-macro2", ] @@ -3242,21 +3392,21 @@ checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f" [[package]] name = "reqwest" -version = "0.11.22" +version = "0.11.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "046cd98826c46c2ac8ddecae268eb5c2e58628688a5fc7a2643704a73faba95b" +checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "bytes", "cookie 0.16.2", "cookie_store", "encoding_rs", "futures-core", "futures-util", - "h2", - "http", - "http-body", - "hyper", + "h2 0.3.23", + "http 0.2.11", + "http-body 0.4.6", + "hyper 0.14.28", "hyper-rustls", "hyper-tls", "ipnet", @@ -3315,9 +3465,9 @@ dependencies = [ [[package]] name = "ring" -version = "0.17.6" +version = "0.17.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "684d5e6e18f669ccebf64a92236bb7db9a34f07be010e3627368182027180866" +checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74" dependencies = [ "cc", "getrandom", @@ -3421,9 +3571,9 @@ dependencies = [ [[package]] name = "rustix" -version = "0.38.26" +version = "0.38.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9470c4bf8246c8daf25f9598dca807fb6510347b1e1cfa55749113850c79d88a" +checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca" dependencies = [ "bitflags 2.4.1", "errno", @@ -3434,12 +3584,12 @@ dependencies = [ [[package]] name = "rustls" -version = "0.21.9" +version = "0.21.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "629648aced5775d558af50b2b4c7b02983a04b312126d45eeead26e7caa498b9" +checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba" dependencies = [ "log", - "ring 0.17.6", + "ring 0.17.7", "rustls-webpki", "sct", ] @@ -3462,7 +3612,7 @@ version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", ] [[package]] @@ -3471,7 +3621,7 @@ version = "0.101.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765" dependencies = [ - "ring 0.17.6", + "ring 0.17.7", "untrusted 0.9.0", ] @@ -3483,9 +3633,9 @@ checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4" [[package]] name = "ryu" -version = "1.0.15" +version = "1.0.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741" +checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c" [[package]] name = "same-file" @@ -3522,11 +3672,11 @@ dependencies = [ [[package]] name = "schannel" -version = "0.1.22" +version = "0.1.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88" +checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.52.0", ] [[package]] @@ -3541,7 +3691,7 @@ version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414" dependencies = [ - "ring 0.17.6", + "ring 0.17.7", "untrusted 0.9.0", ] @@ -3561,9 +3711,9 @@ dependencies = [ [[package]] name = "secp256k1" -version = "0.28.0" +version = "0.28.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2acea373acb8c21ecb5a23741452acd2593ed44ee3d343e72baaa143bc89d0d5" +checksum = "3f622567e3b4b38154fb8190bcf6b160d7a4301d70595a49195b48c116007a27" dependencies = [ "rand", "secp256k1-sys", @@ -3571,9 +3721,9 @@ dependencies = [ [[package]] name = "secp256k1-sys" -version = "0.9.0" +version = "0.9.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09e67c467c38fd24bd5499dc9a18183b31575c12ee549197e3e20d57aa4fe3b7" +checksum = "e5d1746aae42c19d583c3c1a8c646bfad910498e2051c551a7f2e3c0c9fbb7eb" dependencies = [ "cc", ] @@ -3613,15 +3763,15 @@ dependencies = [ [[package]] name = "semver" -version = "1.0.20" +version = "1.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090" +checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0" [[package]] name = "serde" -version = "1.0.193" +version = "1.0.195" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89" +checksum = "63261df402c67811e9ac6def069e4786148c4563f4b50fd4bf30aa370d626b02" dependencies = [ "serde_derive", ] @@ -3648,20 +3798,20 @@ dependencies = [ [[package]] name = "serde_derive" -version = "1.0.193" +version = "1.0.195" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3" +checksum = "46fe8f8603d81ba86327b23a2e9cdf49e1255fb94a4c5f297f6ee0547178ea2c" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] name = "serde_json" -version = "1.0.108" +version = "1.0.111" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b" +checksum = "176e46fa42316f18edd598015a5166857fc835ec732f5215eac6b7bdbf0a84f4" dependencies = [ "itoa", "ryu", @@ -3670,9 +3820,9 @@ dependencies = [ [[package]] name = "serde_path_to_error" -version = "0.1.14" +version = "0.1.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4beec8bce849d58d06238cb50db2e1c417cfeafa4c63f692b15c82b7c80f8335" +checksum = "ebd154a240de39fdebcf5775d2675c204d7c13cf39a4c697be6493c8e734337c" dependencies = [ "itoa", "serde", @@ -3716,7 +3866,7 @@ version = "3.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "64cd236ccc1b7a29e7e2739f27c0b2dd199804abc4290e32f59f3b68d6405c23" dependencies = [ - "base64 0.21.5", + "base64 0.21.7", "chrono", "hex", "indexmap 1.9.3", @@ -3736,7 +3886,7 @@ dependencies = [ "darling", "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -3852,19 +4002,9 @@ dependencies = [ [[package]] name = "smallvec" -version = "1.11.2" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970" - -[[package]] -name = "socket2" -version = "0.4.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d" -dependencies = [ - "libc", - "winapi", -] +checksum = "2593d31f82ead8df961d8bd23a64c2ccf2eb5dd34b0a34bfb4dd54011c72009e" [[package]] name = "socket2" @@ -3903,11 +4043,11 @@ dependencies = [ [[package]] name = "sqlformat" -version = "0.2.2" +version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b7b278788e7be4d0d29c0f39497a0eef3fba6bbc8e70d8bf7fde46edeaa9e85" +checksum = "ce81b7bd7c4493975347ef60d8c7e8b742d4694f4c49f93e0a12ea263938176c" dependencies = [ - "itertools 0.11.0", + "itertools 0.12.0", "nom", "unicode_categories", ] @@ -4016,7 +4156,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e37195395df71fd068f6e2082247891bc11e3289624bbc776a0cdfa1ca7f1ea4" dependencies = [ "atoi", - "base64 0.21.5", + "base64 0.21.7", "bitflags 2.4.1", "byteorder", "bytes", @@ -4060,7 +4200,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d6ac0ac3b7ccd10cc96c7ab29791a7dd236bd94021f31eec7ba3d46a74aa1c24" dependencies = [ "atoi", - "base64 0.21.5", + "base64 0.21.7", "bitflags 2.4.1", "byteorder", "chrono", @@ -4173,7 +4313,7 @@ checksum = "f14a349c27ebe59faba22f933c9c734d428da7231e88a247e9d8c61eea964ddb" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -4195,7 +4335,7 @@ dependencies = [ "proc-macro2", "quote", "rustversion", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -4217,9 +4357,9 @@ dependencies = [ [[package]] name = "syn" -version = "2.0.39" +version = "2.0.48" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a" +checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f" dependencies = [ "proc-macro2", "quote", @@ -4273,15 +4413,15 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369" [[package]] name = "tempfile" -version = "3.8.1" +version = "3.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5" +checksum = "01ce4141aa927a6d1bd34a041795abd0db1cccba5d5f24b009f694bdf3a1f3fa" dependencies = [ "cfg-if", "fastrand", "redox_syscall", "rustix", - "windows-sys 0.48.0", + "windows-sys 0.52.0", ] [[package]] @@ -4308,22 +4448,22 @@ dependencies = [ [[package]] name = "thiserror" -version = "1.0.50" +version = "1.0.56" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2" +checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad" dependencies = [ "thiserror-impl", ] [[package]] name = "thiserror-impl" -version = "1.0.50" +version = "1.0.56" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8" +checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -4338,9 +4478,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.30" +version = "0.3.31" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5" +checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e" dependencies = [ "deranged", "itoa", @@ -4358,9 +4498,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" [[package]] name = "time-macros" -version = "0.2.15" +version = "0.2.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20" +checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f" dependencies = [ "time-core", ] @@ -4391,9 +4531,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.34.0" +version = "1.35.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d0c014766411e834f7af5b8f4cf46257aab4036ca95e9d2c144a10f59ad6f5b9" +checksum = "c89b4efa943be685f629b149f53829423f8f5531ea21249408e8e2f8671ec104" dependencies = [ "backtrace", "bytes", @@ -4402,7 +4542,7 @@ dependencies = [ "num_cpus", "parking_lot", "pin-project-lite", - "socket2 0.5.5", + "socket2", "tokio-macros", "windows-sys 0.48.0", ] @@ -4425,7 +4565,7 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -4501,6 +4641,17 @@ dependencies = [ "winnow", ] +[[package]] +name = "toml_edit" +version = "0.21.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d34d383cd00a163b4a5b85053df514d45bc330f6de7737edfe0a93311d1eaa03" +dependencies = [ + "indexmap 2.1.0", + "toml_datetime", + "winnow", +] + [[package]] name = "tonic" version = "0.10.2" @@ -4509,14 +4660,14 @@ checksum = "d560933a0de61cf715926b9cac824d4c883c2c43142f787595e48280c40a1d0e" dependencies = [ "async-stream", "async-trait", - "axum", - "base64 0.21.5", + "axum 0.6.20", + "base64 0.21.7", "bytes", "flate2", - "h2", - "http", - "http-body", - "hyper", + "h2 0.3.23", + "http 0.2.11", + "http-body 0.4.6", + "hyper 0.14.28", "hyper-timeout", "percent-encoding", "pin-project", @@ -4543,7 +4694,7 @@ dependencies = [ "proc-macro2", "prost-build", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -4566,35 +4717,18 @@ dependencies = [ "tracing", ] -[[package]] -name = "tower-cookies" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "40f38d941a2ffd8402b36e02ae407637a9caceb693aaf2edc910437db0f36984" -dependencies = [ - "async-trait", - "axum-core", - "cookie 0.17.0", - "futures-util", - "http", - "parking_lot", - "pin-project-lite", - "tower-layer", - "tower-service", -] - [[package]] name = "tower-http" -version = "0.4.4" +version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c5bb1d698276a2443e5ecfabc1008bf15a36c12e6a7176e7bf089ea9131140" +checksum = "0da193277a4e2c33e59e09b5861580c33dd0a637c3883d0fa74ba40c0374af2e" dependencies = [ "bitflags 2.4.1", "bytes", - "futures-core", "futures-util", - "http", - "http-body", + "http 1.0.0", + "http-body 1.0.0", + "http-body-util", "http-range-header", "httpdate", "mime", @@ -4640,7 +4774,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -4684,9 +4818,9 @@ dependencies = [ [[package]] name = "try-lock" -version = "0.2.4" +version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed" +checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "typenum" @@ -4793,9 +4927,9 @@ dependencies = [ [[package]] name = "unicode-bidi" -version = "0.3.13" +version = "0.3.14" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460" +checksum = "6f2528f27a9eb2b21e69c95319b30bd0efd85d09c379741b0f78ea1d86be2416" [[package]] name = "unicode-ident" @@ -4937,9 +5071,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" [[package]] name = "wasm-bindgen" -version = "0.2.89" +version = "0.2.90" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ed0d4f68a3015cc185aff4db9506a015f4b96f95303897bfa23f846db54064e" +checksum = "b1223296a201415c7fad14792dbefaace9bd52b62d33453ade1c5b5f07555406" dependencies = [ "cfg-if", "wasm-bindgen-macro", @@ -4947,24 +5081,24 @@ dependencies = [ [[package]] name = "wasm-bindgen-backend" -version = "0.2.89" +version = "0.2.90" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b56f625e64f3a1084ded111c4d5f477df9f8c92df113852fa5a374dbda78826" +checksum = "fcdc935b63408d58a32f8cc9738a0bffd8f05cc7c002086c6ef20b7312ad9dcd" dependencies = [ "bumpalo", "log", "once_cell", "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-futures" -version = "0.4.39" +version = "0.4.40" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac36a15a220124ac510204aec1c3e5db8a22ab06fd6706d881dc6149f8ed9a12" +checksum = "bde2032aeb86bdfaecc8b261eef3cba735cc426c1f3a3416d1e0791be95fc461" dependencies = [ "cfg-if", "js-sys", @@ -4974,9 +5108,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro" -version = "0.2.89" +version = "0.2.90" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0162dbf37223cd2afce98f3d0785506dcb8d266223983e4b5b525859e6e182b2" +checksum = "3e4c238561b2d428924c49815533a8b9121c664599558a5d9ec51f8a1740a999" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -4984,22 +5118,22 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.89" +version = "0.2.90" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0eb82fcb7930ae6219a7ecfd55b217f5f0893484b7a13022ebb2b2bf20b5283" +checksum = "bae1abb6806dc1ad9e560ed242107c0f6c84335f1749dd4e8ddb012ebd5e25a7" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", "wasm-bindgen-backend", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-shared" -version = "0.2.89" +version = "0.2.90" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ab9b36309365056cd639da3134bf87fa8f3d86008abf99e612384a6eecd459f" +checksum = "4d91413b1c31d7539ba5ef2451af3f0b833a005eb27a631cec32bc0635a8602b" [[package]] name = "wasm-streams" @@ -5016,9 +5150,9 @@ dependencies = [ [[package]] name = "web-sys" -version = "0.3.66" +version = "0.3.67" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "50c24a44ec86bb68fbecd1b3efed7e85ea5621b39b35ef2766b66cd984f8010f" +checksum = "58cd2333b6e0be7a39605f0e255892fd7418a682d8da8fe042fe25128794d2ed" dependencies = [ "js-sys", "wasm-bindgen", @@ -5150,11 +5284,11 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" [[package]] name = "windows-core" -version = "0.51.1" +version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1f8cf84f35d2db49a46868f947758c7a1138116f7fac3bc844f43ade1292e64" +checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9" dependencies = [ - "windows-targets 0.48.5", + "windows-targets 0.52.0", ] [[package]] @@ -5291,9 +5425,9 @@ checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04" [[package]] name = "winnow" -version = "0.5.24" +version = "0.5.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0383266b19108dfc6314a56047aa545a1b4d1be60e799b4dbdd407b56402704b" +checksum = "b7cf47b659b318dccbd69cc4797a39ae128f533dce7902a1096044d1967b9c16" dependencies = [ "memchr", ] @@ -5358,22 +5492,22 @@ dependencies = [ [[package]] name = "zerocopy" -version = "0.7.28" +version = "0.7.32" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d6f15f7ade05d2a4935e34a457b936c23dc70a05cc1d97133dc99e7a3fe0f0e" +checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be" dependencies = [ "zerocopy-derive", ] [[package]] name = "zerocopy-derive" -version = "0.7.28" +version = "0.7.32" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dbbad221e3f78500350ecbd7dfa4e63ef945c05f4c61cb7f4d3f84cd0bba649b" +checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] [[package]] @@ -5393,5 +5527,5 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69" dependencies = [ "proc-macro2", "quote", - "syn 2.0.39", + "syn 2.0.48", ] diff --git a/Cargo.toml b/Cargo.toml index 63b96f516..295615098 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,7 +1,10 @@ [package] name = "defguard" -version = "0.8.0" +version = "0.9.0" edition = "2021" +license = "Apache-2.0" +homepage = "https://defguard.net/" +repository = "https://github.com/DefGuard/defguard" [workspace] @@ -9,10 +12,14 @@ edition = "2021" model_derive = { path = "model-derive" } anyhow = "1.0" argon2 = { version = "0.5", features = ["std"] } -axum = { version = "0.6", features = ["headers"] } -axum-client-ip = "0.4" +axum = { version = "0.7" } +axum-client-ip = "0.5" +axum-extra = { version = "0.9", features = [ + "cookie", + "cookie-private", + "typed-header", +] } base64 = "0.21" -bincode = "1.3" chrono = { version = "0.4", default-features = false, features = [ "clock", "serde", @@ -25,7 +32,7 @@ humantime = "2.1" # match ipnetwork version from sqlx ipnetwork = { version = "0.20", features = ["serde"] } jsonwebtoken = "9.2" -ldap3 = "0.11" +ldap3 = { version = "0.11", default-features = false, features = ["tls"] } lettre = { version = "0.11", features = ["tokio1", "tokio1-native-tls"] } md4 = "0.10" otpauth = "0.4" @@ -58,8 +65,11 @@ sqlx = { version = "0.7", features = [ "postgres", "uuid", ] } +struct-patch = "0.4" tera = "1.19" thiserror = "1.0" +# match axum-extra -> cookies +time = { version = "0.3", default-features = false } tiny-keccak = { version = "2.0", features = ["keccak"] } tokio = { version = "1", features = [ "macros", @@ -71,8 +81,7 @@ tokio = { version = "1", features = [ ] } tokio-stream = "0.1" tonic = { version = "0.10", features = ["gzip", "tls", "tls-roots"] } -tower-cookies = { version = "0.9", features = ["private"] } -tower-http = { version = "0.4", features = ["fs", "trace"] } +tower-http = { version = "0.5", features = ["fs", "trace"] } tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter"] } uaparser = "0.6" @@ -83,7 +92,6 @@ webauthn-rs = { version = "0.4", features = [ ] } webauthn-rs-proto = "0.4" x25519-dalek = { version = "2.0", features = ["static_secrets"] } -struct-patch = "0.4" [dev-dependencies] bytes = "1.5" diff --git a/Dockerfile b/Dockerfile index 574a987c0..cf8e819f6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM rust:1.74 as chef +FROM rust:1.75 as chef WORKDIR /build diff --git a/README.md b/README.md index 0e5b3196d..1949dd898 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ defguard

-defguard is a **single binary! SSO & VPN Server** based on **OpenID and Wireguard VPN** with unique secure&private architecture for **building secure and privacy-aware organizations**. +defguard is a **single binary! SSO & VPN Server** based on **OpenID and WireGuard VPN** with unique secure&private architecture for **building secure and privacy-aware organizations**. **It's secure by design**, and can be deployed like all other typical VPNs/SSO (any server/network segment) or **defguard core can be deployed in your secure network segments** (available only from an internal network or by VPN) and operations that require **public access** (like user onboarding, enrollment, password reset, etc.) are done using a **secure proxy** (deployed in the DMZ segmenet with Internet access). @@ -16,8 +16,8 @@ Read more about this in [our documentation](https://defguard.gitbook.io/defguard - LDAP (tested on [OpenLDAP](https://www.openldap.org/)) synchronization - [forward auth](https://defguard.gitbook.io/defguard/features/forward-auth) for reverse proxies (tested with Traefik and Caddy) - nice UI to manage users - - Users **self-service** (besides typical data management, users can revoke access to granted apps, MFA, Wireguard, etc.) -* [Wireguard:tm:](https://www.wireguard.com/) VPN management with: + - Users **self-service** (besides typical data management, users can revoke access to granted apps, MFA, WireGuard, etc.) +* [WireGuard:tm:](https://www.wireguard.com/) VPN management with: - multiple VPN Locations (networks/sites) - with defined access (all users or only Admin group) - multiple [Gateways](https://github.com/DefGuard/gateway) for each VPN Location (**high availability/failover**) - supported on a cluster of routers/firewalls for Linux, FreeBSD/PFSense/OPNSense - **import your current WireGuard server configuration (with a wizard!)** diff --git a/build.rs b/build.rs index 77a9db993..1fda0abc2 100644 --- a/build.rs +++ b/build.rs @@ -5,17 +5,12 @@ fn main() -> Result<(), Box> { config, &[ "proto/core/auth.proto", + "proto/core/proxy.proto", "proto/core/vpn.proto", "proto/worker/worker.proto", "proto/wireguard/gateway.proto", - "proto/enrollment/enrollment.proto", - ], - &[ - "proto/core", - "proto/worker", - "proto/wireguard", - "proto/enrollment", ], + &["proto/core", "proto/worker", "proto/wireguard"], )?; println!("cargo:rerun-if-changed=proto"); println!("cargo:rerun-if-changed=migrations"); diff --git a/docker-compose.e2e.yaml b/docker-compose.e2e.yaml index 739cb5069..49129382d 100644 --- a/docker-compose.e2e.yaml +++ b/docker-compose.e2e.yaml @@ -20,11 +20,12 @@ services: DEFGUARD_DB_PASSWORD: defguard DEFGUARD_DB_NAME: defguard DEFGUARD_URL: http://localhost:8000 + DEFGUARD_PROXY_URL: http://proxy:50052 RUST_BACKTRACE: 1 ports: - # rest api + # REST API - "8000:8000" - # grpc + # gRPC - "50055:50055" depends_on: - db @@ -56,6 +57,9 @@ services: proxy: image: ghcr.io/defguard/defguard-proxy:current ports: + # REST API - "8080:8080" + # gRPC + - "50052:50052" environment: - DEFGUARD_PROXY_UPSTREAM_GRPC_URL: "http://core:50055/" + DEFGUARD_PROXY_GRPC_PORT: 50052 diff --git a/docker-compose.ldap.yaml b/docker-compose.ldap.yaml index e89682e39..d078bfb2c 100644 --- a/docker-compose.ldap.yaml +++ b/docker-compose.ldap.yaml @@ -38,7 +38,7 @@ services: DEFGUARD_TOKEN: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJEZWZHdWFyZCIsInN1YiI6IlRlc3ROZXQiLCJjbGllbnRfaWQiOiIiLCJleHAiOjU5NjE3NDcwNzYsIm5iZiI6MTY2Njc3OTc4MSwicm9sZXMiOltdfQ.uEUMnw_gO23W0K2q3N1lToeP0D2zAY1swr8N-84sRHA RUST_LOG: debug ports: - # wireguard endpoint + # WireGuard endpoint - "50051:50051/udp" depends_on: - core diff --git a/docker-compose.yaml b/docker-compose.yaml index 233a98ac3..80f18a65a 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -35,7 +35,7 @@ services: DEFGUARD_TOKEN: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJEZWZHdWFyZCIsInN1YiI6IlRlc3ROZXQiLCJjbGllbnRfaWQiOiIiLCJleHAiOjU5NjE3NDcwNzYsIm5iZiI6MTY2Njc3OTc4MSwicm9sZXMiOltdfQ.uEUMnw_gO23W0K2q3N1lToeP0D2zAY1swr8N-84sRHA RUST_LOG: debug ports: - # wireguard endpoint + # WireGuard endpoint - "50051:50051/udp" depends_on: - core diff --git a/e2e/README.md b/e2e/README.md new file mode 100644 index 000000000..4b8df1932 --- /dev/null +++ b/e2e/README.md @@ -0,0 +1,26 @@ +# Defguard E2E tests powered by Playwright + +## Prerequisites + +- Docker +- Docker compose +- Node +- pnpm + +## How to run +Pull docker images: +```bash +docker-compose --file ../docker-compose.e2e.yaml pull +``` +Install packages: +```bash +pnpm install +``` +Install playwright chromium driver: +```bash +npx playwright install --with-deps chromium +``` +Run tests: +```bash +pnpm test +``` diff --git a/e2e/tests/enrollment.spec.ts b/e2e/tests/enrollment.spec.ts index 5d544491b..2e6725c7c 100644 --- a/e2e/tests/enrollment.spec.ts +++ b/e2e/tests/enrollment.spec.ts @@ -7,6 +7,7 @@ import { createDevice, createUserEnrollment, password, + selectEnrollment, setPassword, setToken, validateData, @@ -44,6 +45,7 @@ test.describe('Create user with enrollment enabled', () => { await waitForBase(page); await page.goto(testsConfig.ENROLLMENT_URL); await waitForPromise(2000); + await selectEnrollment(page); await setToken(token, page); // Welcome page await page.getByTestId('enrollment-next').click(); diff --git a/e2e/tests/passwordReset.spec.ts b/e2e/tests/passwordReset.spec.ts new file mode 100644 index 000000000..e0aaa117d --- /dev/null +++ b/e2e/tests/passwordReset.spec.ts @@ -0,0 +1,53 @@ +import { test } from '@playwright/test'; + +import { testsConfig, testUserTemplate } from '../config'; +import { User } from '../types'; +import { createUser } from '../utils/controllers/createUser'; +import { loginBasic } from '../utils/controllers/login'; +import { logout } from '../utils/controllers/logout'; +import { + selectPasswordReset, + setEmail, + setPassword, +} from '../utils/controllers/passwordReset'; +import { getPasswordResetToken } from '../utils/db/getPasswordResetToken'; +import { dockerDown, dockerRestart } from '../utils/docker'; +import { waitForBase } from '../utils/waitForBase'; +import { waitForPromise } from '../utils/waitForPromise'; + +const newPassword = '!7(8o3aN8RoF'; + +test.describe('Reset password', () => { + const user: User = { ...testUserTemplate, username: 'test' }; + + test.beforeEach(async ({ browser }) => { + dockerRestart(); + await createUser(browser, user); + }); + + test.afterAll(() => { + dockerDown(); + }); + + test('Reset user password', async ({ page }) => { + await waitForBase(page); + await page.goto(testsConfig.ENROLLMENT_URL); + await waitForPromise(2000); + await selectPasswordReset(page); + await setEmail(user.mail, page); + + await page.getByTestId('email-sent-message').waitFor({ state: 'visible' }); + + const token = await getPasswordResetToken(user.mail); + + await page.goto(`${testsConfig.ENROLLMENT_URL}/password-reset/?token=${token}`); + await waitForPromise(2000); + + await setPassword(newPassword, page); + await page.getByTestId('password-reset-success').waitFor({ state: 'visible' }); + + await waitForBase(page); + await loginBasic(page, { ...user, password: newPassword }); + await logout(page); + }); +}); diff --git a/e2e/utils/controllers/enrollment.ts b/e2e/utils/controllers/enrollment.ts index 504a4b8f9..8a26c2632 100644 --- a/e2e/utils/controllers/enrollment.ts +++ b/e2e/utils/controllers/enrollment.ts @@ -55,10 +55,15 @@ export const createUserEnrollment = async ( return { user, token }; }; +export const selectEnrollment = async (page: Page) => { + const selectButton = page.getByTestId('select-enrollment'); + selectButton.click(); +}; + export const setToken = async (token: string, page: Page) => { const formElement = page.getByTestId('enrollment-token-form'); await formElement.getByTestId('field-token').type(token); - await formElement.locator('button[type="submit"]').click(); + await page.getByTestId('enrollment-token-submit-button').click(); }; export const validateData = async (user: User, page: Page) => { diff --git a/e2e/utils/controllers/passwordReset.ts b/e2e/utils/controllers/passwordReset.ts new file mode 100644 index 000000000..6271eb4a3 --- /dev/null +++ b/e2e/utils/controllers/passwordReset.ts @@ -0,0 +1,17 @@ +import { Page } from 'playwright'; + +export const selectPasswordReset = async (page: Page) => { + const selectButton = page.getByTestId('select-password-reset'); + selectButton.click(); +}; + +export const setEmail = async (token: string, page: Page) => { + await page.getByTestId('field-email').type(token); + await page.getByTestId('password-reset-email-submit-button').click(); +}; + +export const setPassword = async (password: string, page: Page) => { + await page.getByTestId('field-password').type(password); + await page.getByTestId('field-repeat').type(password); + await page.getByTestId('password-reset-submit').click(); +}; diff --git a/e2e/utils/db/getPasswordResetToken.ts b/e2e/utils/db/getPasswordResetToken.ts new file mode 100644 index 000000000..0594c421a --- /dev/null +++ b/e2e/utils/db/getPasswordResetToken.ts @@ -0,0 +1,18 @@ +import { expect } from '@playwright/test'; + +import { makeConnection } from './makeConnection'; + +export const getPasswordResetToken = async (email: string): Promise => { + const client = await makeConnection(); + const sql = `select id from "token" where email='${email}';`; + try { + const result = await client.query(sql); + expect(result.rows.length).toBeGreaterThan(0); + const token = result.rows[0]['id']; + expect(token).toBeDefined(); + expect(token?.length).toBeGreaterThan(0); + return token; + } finally { + await client.end(); + } +}; diff --git a/migrations/20231207160414_enrollment_table_generic.down.sql b/migrations/20231207160414_enrollment_table_generic.down.sql new file mode 100644 index 000000000..fd4e54920 --- /dev/null +++ b/migrations/20231207160414_enrollment_table_generic.down.sql @@ -0,0 +1,3 @@ +ALTER TABLE token RENAME TO enrollment; +ALTER TABLE enrollment ALTER admin_id SET NOT NULL; +ALTER TABLE enrollment DROP token_type; diff --git a/migrations/20231207160414_enrollment_table_generic.up.sql b/migrations/20231207160414_enrollment_table_generic.up.sql new file mode 100644 index 000000000..0379924a8 --- /dev/null +++ b/migrations/20231207160414_enrollment_table_generic.up.sql @@ -0,0 +1,3 @@ +ALTER TABLE enrollment ALTER admin_id DROP NOT NULL; +ALTER TABLE enrollment ADD COLUMN token_type text DEFAULT 'ENROLLMENT'; +ALTER TABLE enrollment RENAME TO token; diff --git a/migrations/20231220103051_add_preshared_key.down.sql b/migrations/20231220103051_add_preshared_key.down.sql new file mode 100644 index 000000000..8466e6f04 --- /dev/null +++ b/migrations/20231220103051_add_preshared_key.down.sql @@ -0,0 +1 @@ +ALTER TABLE device DROP COLUMN preshared_key; diff --git a/migrations/20231220103051_add_preshared_key.up.sql b/migrations/20231220103051_add_preshared_key.up.sql new file mode 100644 index 000000000..d12c2c1c2 --- /dev/null +++ b/migrations/20231220103051_add_preshared_key.up.sql @@ -0,0 +1 @@ +ALTER TABLE device ADD COLUMN preshared_key text NULL; diff --git a/migrations/20231220112404_update_location_settings.down.sql b/migrations/20231220112404_update_location_settings.down.sql new file mode 100644 index 000000000..899287ebd --- /dev/null +++ b/migrations/20231220112404_update_location_settings.down.sql @@ -0,0 +1,3 @@ +ALTER TABLE wireguard_network DROP COLUMN mfa_enabled; +ALTER TABLE wireguard_network DROP COLUMN keepalive_interval; +ALTER TABLE wireguard_network DROP COLUMN peer_disconnect_threshold; diff --git a/migrations/20231220112404_update_location_settings.up.sql b/migrations/20231220112404_update_location_settings.up.sql new file mode 100644 index 000000000..a0210bfdb --- /dev/null +++ b/migrations/20231220112404_update_location_settings.up.sql @@ -0,0 +1,3 @@ +ALTER TABLE wireguard_network ADD COLUMN mfa_enabled bool NOT NULL DEFAULT false; +ALTER TABLE wireguard_network ADD COLUMN keepalive_interval int4 NOT NULL DEFAULT 25; +ALTER TABLE wireguard_network ADD COLUMN peer_disconnect_threshold int4 NOT NULL DEFAULT 75; diff --git a/migrations/20231222094917_support_gateway_disconnect.down.sql b/migrations/20231222094917_support_gateway_disconnect.down.sql new file mode 100644 index 000000000..3381636e3 --- /dev/null +++ b/migrations/20231222094917_support_gateway_disconnect.down.sql @@ -0,0 +1 @@ +ALTER TABLE wireguard_network_device DROP COLUMN is_authorized; diff --git a/migrations/20231222094917_support_gateway_disconnect.up.sql b/migrations/20231222094917_support_gateway_disconnect.up.sql new file mode 100644 index 000000000..45c49cd96 --- /dev/null +++ b/migrations/20231222094917_support_gateway_disconnect.up.sql @@ -0,0 +1 @@ +ALTER TABLE wireguard_network_device ADD COLUMN is_authorized bool NOT NULL DEFAULT false; diff --git a/migrations/20231227091628_fix_preshared_key.down.sql b/migrations/20231227091628_fix_preshared_key.down.sql new file mode 100644 index 000000000..f3574d87d --- /dev/null +++ b/migrations/20231227091628_fix_preshared_key.down.sql @@ -0,0 +1,4 @@ +ALTER TABLE device ADD COLUMN preshared_key text NULL; + +-- remove previous column +ALTER TABLE wireguard_network_device DROP COLUMN preshared_key; diff --git a/migrations/20231227091628_fix_preshared_key.up.sql b/migrations/20231227091628_fix_preshared_key.up.sql new file mode 100644 index 000000000..41e5db5e0 --- /dev/null +++ b/migrations/20231227091628_fix_preshared_key.up.sql @@ -0,0 +1,4 @@ +ALTER TABLE wireguard_network_device ADD COLUMN preshared_key text NULL; + +-- remove previous column +ALTER TABLE device DROP COLUMN preshared_key; diff --git a/model-derive/src/lib.rs b/model-derive/src/lib.rs index 3b277bffc..acff2d332 100644 --- a/model-derive/src/lib.rs +++ b/model-derive/src/lib.rs @@ -77,13 +77,11 @@ pub fn derive(input: TokenStream) -> TokenStream { } } - let fields = if let Data::Struct(DataStruct { + let Data::Struct(DataStruct { fields: Fields::Named(FieldsNamed { named, .. }), .. }) = ast.data - { - named - } else { + else { // fail for other but `struct` unimplemented!(); }; @@ -99,7 +97,7 @@ pub fn derive(input: TokenStream) -> TokenStream { let mut add_comma = false; let mut value_number = 1; - fields.iter().for_each(|field| { + named.iter().for_each(|field| { if let Some(name) = &field.ident { if name != "id" { if add_comma { @@ -144,7 +142,7 @@ pub fn derive(input: TokenStream) -> TokenStream { // TODO: handle fields wrapped in Option // field arguments for queries - let insert_args = fields.iter().filter_map(|field| { + let insert_args = named.iter().filter_map(|field| { if let Some(name) = &field.ident { if name != "id" { if let Some(tokens) = model_attr(field) { @@ -179,7 +177,7 @@ pub fn derive(input: TokenStream) -> TokenStream { impl #name { pub async fn find_by_id<'e, E>(executor: E, id: i64) -> Result, sqlx::Error> where - E: sqlx::Executor<'e, Database = sqlx::Postgres> + E: sqlx::PgExecutor<'e> { sqlx::query_as!(Self, #find_by_id_query, id).fetch_optional(executor).await } @@ -187,14 +185,14 @@ pub fn derive(input: TokenStream) -> TokenStream { // TODO: add limit and offset pub async fn all<'e, E>(executor: E) -> Result, sqlx::Error> where - E: sqlx::Executor<'e, Database = sqlx::Postgres> + E: sqlx::PgExecutor<'e> { sqlx::query_as!(Self, #all_query).fetch_all(executor).await } pub async fn delete<'e, E>(self, executor: E) -> Result<(), sqlx::Error> where - E: sqlx::Executor<'e, Database = sqlx::Postgres> + E: sqlx::PgExecutor<'e> { if let Some(id) = self.id { sqlx::query!(#delete_query, id).execute(executor).await?; @@ -204,7 +202,7 @@ pub fn derive(input: TokenStream) -> TokenStream { pub async fn save<'e, E>(&mut self, executor: E) -> Result<(), sqlx::Error> where - E: sqlx::Executor<'e, Database = sqlx::Postgres> + E: sqlx::PgExecutor<'e> { match self.id { None => { diff --git a/proto b/proto index 50f3791a2..a5776f47e 160000 --- a/proto +++ b/proto @@ -1 +1 @@ -Subproject commit 50f3791a2d0104ad7d9ae69a3abde070743902c2 +Subproject commit a5776f47e0a9ffb7e408401662f3e5a4ced205d9 diff --git a/rust-toolchain.toml b/rust-toolchain.toml index 71326c3d7..6d833ff50 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.74" +channel = "1.75" diff --git a/sqlx-data.json b/sqlx-data.json deleted file mode 100644 index 95c8c858b..000000000 --- a/sqlx-data.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "db": "PostgreSQL" -} \ No newline at end of file diff --git a/src/appstate.rs b/src/appstate.rs index e44b0785d..a2632a749 100644 --- a/src/appstate.rs +++ b/src/appstate.rs @@ -1,12 +1,10 @@ -use crate::{ - auth::failed_login::FailedLoginMap, - config::DefGuardConfig, - db::{AppEvent, DbPool, GatewayEvent, WebHook}, - mail::Mail, -}; +use std::sync::{Arc, Mutex}; + +use axum::extract::FromRef; +use axum_extra::extract::cookie::Key; use reqwest::Client; +use secrecy::ExposeSecret; use serde_json::json; -use std::sync::{Arc, Mutex}; use tokio::{ sync::{ broadcast::Sender, @@ -17,6 +15,13 @@ use tokio::{ use uaparser::UserAgentParser; use webauthn_rs::prelude::*; +use crate::{ + auth::failed_login::FailedLoginMap, + config::DefGuardConfig, + db::{AppEvent, DbPool, GatewayEvent, WebHook}, + mail::Mail, +}; + #[derive(Clone)] pub struct AppState { pub config: DefGuardConfig, @@ -27,16 +32,18 @@ pub struct AppState { pub webauthn: Arc, pub user_agent_parser: Arc, pub failed_logins: Arc>, + key: Key, } impl AppState { - pub fn trigger_action(&self, event: AppEvent) { + pub(crate) fn trigger_action(&self, event: AppEvent) { let event_name = event.name().to_owned(); match self.tx.send(event) { Ok(()) => info!("Sent trigger {event_name}"), Err(err) => error!("Error sending trigger {event_name}: {err}"), } } + /// Handle webhook events async fn handle_triggers(pool: DbPool, mut rx: UnboundedReceiver) { let reqwest_client = Client::builder().user_agent("reqwest").build().unwrap(); @@ -77,7 +84,7 @@ impl AppState { /// Sends given `GatewayEvent` to be handled by gateway GRPC server pub fn send_wireguard_event(&self, event: GatewayEvent) { if let Err(err) = self.wireguard_tx.send(event) { - error!("Error sending wireguard event {err}"); + error!("Error sending WireGuard event {err}"); } } @@ -116,6 +123,8 @@ impl AppState { .expect("Invalid WebAuthn configuration"), ); + let key = Key::from(config.secret_key.expose_secret().as_bytes()); + Self { config, pool, @@ -125,6 +134,13 @@ impl AppState { webauthn, user_agent_parser, failed_logins, + key, } } } + +impl FromRef for Key { + fn from_ref(state: &AppState) -> Self { + state.key.clone() + } +} diff --git a/src/auth/failed_login.rs b/src/auth/failed_login.rs index b0036f395..c926b815c 100644 --- a/src/auth/failed_login.rs +++ b/src/auth/failed_login.rs @@ -1,9 +1,6 @@ +use std::{collections::HashMap, sync::Mutex}; + use chrono::{DateTime, Duration, Local}; -use std::{ - collections::HashMap, - ops::DerefMut, - sync::{Arc, Mutex}, -}; use thiserror::Error; // Time window in seconds @@ -67,14 +64,9 @@ impl FailedLogin { // Counter can be reset after enough time has passed since the initial attempt. // If user was blocked we also check if enough time (timeout) has passed since last attempt. fn should_reset_counter(&self) -> bool { - if self.time_since_first_attempt() > Duration::seconds(FAILED_LOGIN_WINDOW) + self.time_since_first_attempt() > Duration::seconds(FAILED_LOGIN_WINDOW) && self.attempt_count < FAILED_LOGIN_COUNT || self.time_since_last_attempt() > Duration::seconds(FAILED_LOGIN_TIMEOUT) - { - return true; - } - - false } } @@ -124,19 +116,19 @@ impl FailedLoginMap { // Check if auth request with a given username can proceed pub fn check_username( - failed_logins: &Arc>, + failed_logins: &Mutex, username: &str, ) -> Result<(), FailedLoginError> { let mut failed_logins = failed_logins .lock() .expect("Failed to get a lock on failed login map."); - failed_logins.deref_mut().verify_username(username) + failed_logins.verify_username(username) } // Helper to log failed login attempt -pub fn log_failed_login_attempt(failed_logins: &Arc>, username: &str) { +pub fn log_failed_login_attempt(failed_logins: &Mutex, username: &str) { let mut failed_logins = failed_logins .lock() .expect("Failed to get a lock on failed login map."); - failed_logins.deref_mut().log_failed_attempt(username); + failed_logins.log_failed_attempt(username); } diff --git a/src/auth/mod.rs b/src/auth/mod.rs index 5d0d0cea3..6fc07679f 100644 --- a/src/auth/mod.rs +++ b/src/auth/mod.rs @@ -10,16 +10,17 @@ use axum::{ extract::{FromRef, FromRequestParts}, http::request::Parts, }; +use axum_extra::extract::cookie::CookieJar; use jsonwebtoken::{ decode, encode, errors::Error as JWTError, DecodingKey, EncodingKey, Header, Validation, }; use serde::{Deserialize, Serialize}; -use tower_cookies::{Cookie, Cookies}; use crate::{ appstate::AppState, - db::{OAuth2AuthorizedApp, OAuth2Token, Session, SessionState, User}, + db::{Group, OAuth2AuthorizedApp, OAuth2Token, Session, SessionState, User}, error::WebError, + handlers::SESSION_COOKIE_NAME, }; pub static JWT_ISSUER: &str = "DefGuard"; @@ -36,6 +37,7 @@ pub enum ClaimsType { Auth, Gateway, YubiBridge, + DesktopClient, } /// Standard claims: https://www.iana.org/assignments/jwt/jwt.xhtml @@ -84,6 +86,7 @@ impl Claims { ClaimsType::Auth => AUTH_SECRET_ENV, ClaimsType::Gateway => GATEWAY_SECRET_ENV, ClaimsType::YubiBridge => YUBIBRIDGE_SECRET_ENV, + ClaimsType::DesktopClient => AUTH_SECRET_ENV, }; env::var(env_var).unwrap_or_default() } @@ -123,14 +126,13 @@ where async fn from_request_parts(parts: &mut Parts, state: &S) -> Result { let appstate = AppState::from_ref(state); - if let Ok(cookies) = Cookies::from_request_parts(parts, state).await { - if let Some(session_cookie) = cookies.get("defguard_session") { + if let Ok(cookies) = CookieJar::from_request_parts(parts, state).await { + if let Some(session_cookie) = cookies.get(SESSION_COOKIE_NAME) { return { match Session::find_by_id(&appstate.pool, session_cookie.value()).await { Ok(Some(session)) => { if session.expired() { let _result = session.delete(&appstate.pool).await; - cookies.remove(Cookie::named("defguard_session")); Err(WebError::Authorization("Session expired".into())) } else { Ok(session) @@ -152,6 +154,7 @@ pub struct SessionInfo { pub session: Session, pub user: User, pub is_admin: bool, + groups: Vec, } impl SessionInfo { @@ -161,8 +164,13 @@ impl SessionInfo { session, user, is_admin, + groups: Vec::new(), } } + + fn contains_group(&self, group_name: &str) -> bool { + self.groups.iter().any(|group| group.name == group_name) + } } #[async_trait] @@ -176,43 +184,63 @@ where async fn from_request_parts(parts: &mut Parts, state: &S) -> Result { let appstate = AppState::from_ref(state); let session = Session::from_request_parts(parts, state).await?; - let user = User::find_by_id(&appstate.pool, session.user_id).await; + let user = User::find_by_id(&appstate.pool, session.user_id).await?; - if let Ok(Some(user)) = user { + if let Some(user) = user { if user.mfa_enabled && session.state != SessionState::MultiFactorVerified { return Err(WebError::Authorization("MFA not verified".into())); } - let is_admin = match user.member_of(&appstate.pool).await { - Ok(groups) => groups.contains(&appstate.config.admin_groupname), - _ => false, + let Ok(groups) = user.member_of(&appstate.pool).await else { + return Err(WebError::DbError("cannot fetch groups".into())); }; - Ok(SessionInfo::new(session, user, is_admin)) + Ok(SessionInfo { + session, + user, + is_admin: groups + .iter() + .any(|group| group.name == appstate.config.admin_groupname), + groups, + }) } else { Err(WebError::Authorization("User not found".into())) } } } -pub struct AdminRole; +#[macro_export] +macro_rules! role { + ($name:ident, $($config_field:ident)*) => { + pub struct $name; -#[async_trait] -impl FromRequestParts for AdminRole -where - S: Send + Sync, - AppState: FromRef, -{ - type Rejection = WebError; + #[async_trait] + impl FromRequestParts for $name + where + S: Send + Sync, + AppState: FromRef, + { + type Rejection = WebError; - async fn from_request_parts(parts: &mut Parts, state: &S) -> Result { - let session_info = SessionInfo::from_request_parts(parts, state).await?; - if session_info.is_admin { - Ok(AdminRole {}) - } else { - Err(WebError::Forbidden("access denied".into())) + async fn from_request_parts( + parts: &mut Parts, + state: &S, + ) -> Result { + let appstate = AppState::from_ref(state); + let session_info = SessionInfo::from_request_parts(parts, state).await?; + $( + if session_info.contains_group(&appstate.config.$config_field) { + return Ok(Self {}); + } + )* + Err(WebError::Forbidden("access denied".into())) + } } - } + }; } +role!(AdminRole, admin_groupname); +role!(UserAdminRole, admin_groupname useradmin_groupname); +role!(VpnRole, admin_groupname vpn_groupname); + // User authenticated by a valid access token pub struct AccessUserInfo(pub(crate) User); diff --git a/src/bin/defguard.rs b/src/bin/defguard.rs index 60f25c616..4b9e397f1 100644 --- a/src/bin/defguard.rs +++ b/src/bin/defguard.rs @@ -1,22 +1,25 @@ +use std::{ + fs::read_to_string, + sync::{Arc, Mutex}, +}; + +use secrecy::ExposeSecret; +use tokio::sync::{broadcast, mpsc::unbounded_channel}; +use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt}; + use defguard::{ auth::failed_login::FailedLoginMap, config::{Command, DefGuardConfig}, db::{init_db, AppEvent, GatewayEvent, Settings, User}, - grpc::{run_grpc_server, GatewayMap, WorkerState}, + grpc::{run_grpc_bidi_stream, run_grpc_server, GatewayMap, WorkerState}, headers::create_user_agent_parser, init_dev_env, init_vpn_location, mail::{run_mail_handler, Mail}, run_web_server, + wireguard_peer_disconnect::run_periodic_peer_disconnect, wireguard_stats_purge::run_periodic_stats_purge, SERVER_CONFIG, }; -use secrecy::ExposeSecret; -use std::{ - fs::read_to_string, - sync::{Arc, Mutex}, -}; -use tokio::sync::{broadcast, mpsc::unbounded_channel}; -use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt}; #[macro_use] extern crate tracing; @@ -42,6 +45,9 @@ async fn main() -> Result<(), anyhow::Error> { .init(); SERVER_CONFIG.set(config.clone())?; + info!("Starting defguard"); + debug!("Using config: {config:?}"); + let pool = init_db( &config.database_host, config.database_port, @@ -67,8 +73,6 @@ async fn main() -> Result<(), anyhow::Error> { return Ok(()); } - debug!("Starting defguard server with config: {config:?}"); - if config.openid_signing_key.is_some() { info!("Using RSA OpenID signing key"); } else { @@ -104,10 +108,12 @@ async fn main() -> Result<(), anyhow::Error> { // run services tokio::select! { - _ = run_grpc_server(&config, Arc::clone(&worker_state), pool.clone(), Arc::clone(&gateway_state), wireguard_tx.clone(), mail_tx.clone(), grpc_cert, grpc_key, user_agent_parser.clone(), failed_logins.clone()) => (), - _ = run_web_server(&config, worker_state, gateway_state, webhook_tx, webhook_rx, wireguard_tx, mail_tx, pool.clone(), user_agent_parser, failed_logins) => (), - () = run_mail_handler(mail_rx, pool.clone()) => (), - _ = run_periodic_stats_purge(pool, config.stats_purge_frequency.into(), config.stats_purge_threshold.into()), if !config.disable_stats_purge => (), + res = run_grpc_bidi_stream(pool.clone(), wireguard_tx.clone(), mail_tx.clone(), user_agent_parser.clone()), if config.proxy_url.is_some() => error!("Proxy gRPC stream returned early: {res:#?}"), + res = run_grpc_server(&config, Arc::clone(&worker_state), pool.clone(), Arc::clone(&gateway_state), wireguard_tx.clone(), mail_tx.clone(), grpc_cert, grpc_key, failed_logins.clone()) => error!("gRPC server returned early: {res:#?}"), + res = run_web_server(&config, worker_state, gateway_state, webhook_tx, webhook_rx, wireguard_tx.clone(), mail_tx, pool.clone(), user_agent_parser, failed_logins) => error!("Web server returned early: {res:#?}"), + res = run_mail_handler(mail_rx, pool.clone()) => error!("Mail handler returned early: {res:#?}"), + res = run_periodic_peer_disconnect(pool.clone(), wireguard_tx) => error!("Periodic peer disconnect task returned early: {res:#?}"), + res = run_periodic_stats_purge(pool, config.stats_purge_frequency.into(), config.stats_purge_threshold.into()), if !config.disable_stats_purge => error!("Periodic stats purge task returned early: {res:#?}"), } Ok(()) } diff --git a/src/config.rs b/src/config.rs index 7c79a5a35..d46a416ec 100644 --- a/src/config.rs +++ b/src/config.rs @@ -58,6 +58,16 @@ pub struct DefGuardConfig { #[arg(long, env = "DEFGUARD_ADMIN_GROUPNAME", default_value = "admin")] pub admin_groupname: String, + #[arg( + long, + env = "DEFGUARD_USERADMIN_GROUPNAME", + default_value = "useradmin" + )] + pub useradmin_groupname: String, + + #[arg(long, env = "DEFGUARD_VPN_GROUPNAME", default_value = "vpn")] + pub vpn_groupname: String, + #[arg( long, env = "DEFGUARD_DEFAULT_ADMIN_PASSWORD", @@ -97,6 +107,14 @@ pub struct DefGuardConfig { #[serde(skip_serializing)] pub enrollment_token_timeout: Duration, + #[arg( + long, + env = "DEFGUARD_PASSWORD_RESET_TOKEN_TIMEOUT", + default_value = "24h" + )] + #[serde(skip_serializing)] + pub password_reset_token_timeout: Duration, + #[arg( long, env = "DEFGUARD_ENROLLMENT_SESSION_TIMEOUT", @@ -105,12 +123,28 @@ pub struct DefGuardConfig { #[serde(skip_serializing)] pub enrollment_session_timeout: Duration, + #[arg( + long, + env = "DEFGUARD_PASSWORD_RESET_SESSION_TIMEOUT", + default_value = "10m" + )] + #[serde(skip_serializing)] + pub password_reset_session_timeout: Duration, + #[arg(long, env = "DEFGUARD_COOKIE_DOMAIN")] pub cookie_domain: Option, #[arg(long, env = "DEFGUARD_COOKIE_INSECURE")] pub cookie_insecure: bool, + // TODO: allow multiple values + #[arg(long, env = "DEFGUARD_PROXY_URL")] + pub proxy_url: Option, + + // path to certificate `.pem` file used if connecting to proxy over HTTPS + #[arg(long, env = "DEFGUARD_PROXY_GRPC_CA")] + pub proxy_grpc_ca: Option, + #[arg( long, env = "DEFGUARD_GATEWAY_DISCONNECTION_NOTIFICATION_TIMEOUT", diff --git a/src/db/mod.rs b/src/db/mod.rs index 7559c1cb2..cbad0a295 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -6,6 +6,7 @@ pub type DbPool = sqlx::postgres::PgPool; /// Initializes and migrates postgres database. Returns DB pool object. pub async fn init_db(host: &str, port: u16, name: &str, user: &str, password: &str) -> DbPool { + info!("Initializing DB pool"); let opts = PgConnectOptions::new() .host(host) .port(port) diff --git a/src/db/models/device.rs b/src/db/models/device.rs index 0439a1164..e4d4dcd59 100644 --- a/src/db/models/device.rs +++ b/src/db/models/device.rs @@ -1,3 +1,15 @@ +use std::{ + fmt::{Display, Formatter}, + net::IpAddr, +}; + +use base64::{prelude::BASE64_STANDARD, Engine}; +use chrono::{NaiveDateTime, Utc}; +use ipnetwork::IpNetwork; +use model_derive::Model; +use sqlx::{query, query_as, Error as SqlxError, FromRow, PgConnection, PgExecutor}; +use thiserror::Error; + use super::{ error::ModelError, wireguard::{WireguardNetwork, WIREGUARD_MAX_HANDSHAKE_MINUTES}, @@ -14,19 +26,10 @@ pub struct DeviceConfig { pub(crate) allowed_ips: Vec, pub(crate) pubkey: String, pub(crate) dns: Option, + pub(crate) mfa_enabled: bool, + pub(crate) keepalive_interval: i32, } -use base64::{prelude::BASE64_STANDARD, Engine}; -use chrono::{NaiveDateTime, Utc}; -use ipnetwork::IpNetwork; -use model_derive::Model; -use sqlx::{query, query_as, Error as SqlxError, FromRow, PgConnection}; -use std::{ - fmt::{Display, Formatter}, - net::IpAddr, -}; -use thiserror::Error; - #[derive(Clone, Deserialize, Model, Serialize, Debug)] pub struct Device { pub id: Option, @@ -39,7 +42,7 @@ pub struct Device { impl Display for Device { fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result { match self.id { - Some(device_id) => write!(f, "[ID {}] {}", device_id, self.name), + Some(device_id) => write!(f, "[ID {device_id}] {}", self.name), None => write!(f, "{}", self.name), } } @@ -57,22 +60,23 @@ pub struct DeviceInfo { pub struct DeviceNetworkInfo { pub network_id: i64, pub device_wireguard_ip: IpAddr, + #[serde(skip_serializing)] + pub preshared_key: Option, + pub is_authorized: bool, } impl DeviceInfo { pub async fn from_device<'e, E>(executor: E, device: Device) -> Result where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { - debug!("Generating device info for {}", device); + debug!("Generating device info for {device}"); let device_id = device.get_id()?; let network_info = query_as!( DeviceNetworkInfo, - r#" - SELECT wireguard_network_id as network_id, wireguard_ip as "device_wireguard_ip: IpAddr" - FROM wireguard_network_device - WHERE device_id = $1 - "#, + "SELECT wireguard_network_id as network_id, wireguard_ip as \"device_wireguard_ip: IpAddr\", preshared_key, is_authorized \ + FROM wireguard_network_device \ + WHERE device_id = $1", device_id ) .fetch_all(executor) @@ -111,23 +115,21 @@ impl UserDevice { if let Some(device_id) = device.id { // fetch device config and connection info for all networks let result = query!( - r#" - WITH stats AS ( - SELECT DISTINCT ON (network) network, endpoint, latest_handshake - FROM wireguard_peer_stats - WHERE device_id = $2 - ORDER BY network, collected_at DESC - ) - SELECT - n.id as network_id, n.name as network_name, n.endpoint as gateway_endpoint, - wnd.wireguard_ip as "device_wireguard_ip: IpAddr", stats.endpoint as device_endpoint, - stats.latest_handshake as "latest_handshake?", - COALESCE (((NOW() - stats.latest_handshake) < $1 * interval '1 minute'), false) as "is_active!" - FROM wireguard_network_device wnd - JOIN wireguard_network n ON n.id = wnd.wireguard_network_id - LEFT JOIN stats on n.id = stats.network - WHERE wnd.device_id = $2 - "#, + "WITH stats AS ( \ + SELECT DISTINCT ON (network) network, endpoint, latest_handshake \ + FROM wireguard_peer_stats \ + WHERE device_id = $2 \ + ORDER BY network, collected_at DESC \ + ) \ + SELECT \ + n.id as network_id, n.name as network_name, n.endpoint as gateway_endpoint, \ + wnd.wireguard_ip as \"device_wireguard_ip: IpAddr\", stats.endpoint as device_endpoint, \ + stats.latest_handshake as \"latest_handshake?\", \ + COALESCE (((NOW() - stats.latest_handshake) < $1 * interval '1 minute'), false) as \"is_active!\" \ + FROM wireguard_network_device wnd \ + JOIN wireguard_network n ON n.id = wnd.wireguard_network_id \ + LEFT JOIN stats on n.id = stats.network \ + WHERE wnd.device_id = $2", WIREGUARD_MAX_HANDSHAKE_MINUTES as f64, device_id, ) @@ -167,6 +169,8 @@ pub struct WireguardNetworkDevice { pub wireguard_network_id: i64, pub wireguard_ip: IpAddr, pub device_id: i64, + pub preshared_key: Option, + pub is_authorized: bool, } #[derive(Serialize, Deserialize, Debug)] @@ -188,22 +192,25 @@ impl WireguardNetworkDevice { wireguard_network_id: network_id, wireguard_ip, device_id, + preshared_key: None, + is_authorized: false, } } pub async fn insert<'e, E>(&self, executor: E) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { query!( - "INSERT INTO wireguard_network_device - (device_id, wireguard_network_id, wireguard_ip) - VALUES ($1, $2, $3) - ON CONFLICT ON CONSTRAINT device_network - DO UPDATE SET wireguard_ip = $3", + "INSERT INTO wireguard_network_device \ + (device_id, wireguard_network_id, wireguard_ip, is_authorized) \ + VALUES ($1, $2, $3, $4) \ + ON CONFLICT ON CONSTRAINT device_network \ + DO UPDATE SET wireguard_ip = $3, is_authorized = $4", self.device_id, self.wireguard_network_id, IpNetwork::from(self.wireguard_ip.clone()), + self.is_authorized, ) .execute(executor) .await?; @@ -212,17 +219,16 @@ impl WireguardNetworkDevice { pub async fn update<'e, E>(&self, executor: E) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { query!( - r#" - UPDATE wireguard_network_device - SET wireguard_ip = $3 - WHERE device_id = $1 AND wireguard_network_id = $2 - "#, + "UPDATE wireguard_network_device \ + SET wireguard_ip = $3, is_authorized = $4 \ + WHERE device_id = $1 AND wireguard_network_id = $2", self.device_id, self.wireguard_network_id, - IpNetwork::from(self.wireguard_ip.clone()) + IpNetwork::from(self.wireguard_ip.clone()), + self.is_authorized, ) .execute(executor) .await?; @@ -231,13 +237,11 @@ impl WireguardNetworkDevice { pub async fn delete<'e, E>(&self, executor: E) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { query!( - r#" - DELETE FROM wireguard_network_device - WHERE device_id = $1 AND wireguard_network_id = $2 - "#, + "DELETE FROM wireguard_network_device \ + WHERE device_id = $1 AND wireguard_network_id = $2", self.device_id, self.wireguard_network_id, ) @@ -252,13 +256,13 @@ impl WireguardNetworkDevice { network_id: i64, ) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { let res = query_as!( Self, - r#"SELECT device_id, wireguard_network_id, wireguard_ip as "wireguard_ip: IpAddr" FROM - wireguard_network_device - WHERE device_id = $1 AND wireguard_network_id = $2"#, + "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\", preshared_key, is_authorized \ + FROM wireguard_network_device \ + WHERE device_id = $1 AND wireguard_network_id = $2", device_id, network_id ) @@ -273,8 +277,8 @@ impl WireguardNetworkDevice { ) -> Result>, SqlxError> { let result = query_as!( Self, - r#"SELECT device_id, wireguard_network_id, wireguard_ip as "wireguard_ip: IpAddr" - FROM wireguard_network_device WHERE device_id = $1"#, + "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\", preshared_key, is_authorized \ + FROM wireguard_network_device WHERE device_id = $1", device_id ) .fetch_all(pool) @@ -290,13 +294,13 @@ impl WireguardNetworkDevice { network_id: i64, ) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { let res = query_as!( Self, - r#"SELECT device_id, wireguard_network_id, wireguard_ip as "wireguard_ip: IpAddr" FROM - wireguard_network_device - WHERE wireguard_network_id = $1"#, + "SELECT device_id, wireguard_network_id, wireguard_ip as \"wireguard_ip: IpAddr\", preshared_key, is_authorized \ + FROM wireguard_network_device \ + WHERE wireguard_network_id = $1", network_id ) .fetch_all(executor) @@ -387,15 +391,15 @@ impl Device { network_id: i64, ) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { query_as!( Self, - r#"SELECT d.id "id?", d.name, d.wireguard_pubkey, d.user_id, d.created - FROM device d - JOIN wireguard_network_device wnd - ON d.id = wnd.device_id - WHERE wnd.wireguard_ip = $1 AND wnd.wireguard_network_id = $2"#, + "SELECT d.id \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created \ + FROM device d \ + JOIN wireguard_network_device wnd \ + ON d.id = wnd.device_id \ + WHERE wnd.wireguard_ip = $1 AND wnd.wireguard_network_id = $2", IpNetwork::from(ip), network_id ) @@ -405,7 +409,7 @@ impl Device { pub async fn find_by_pubkey<'e, E>(executor: E, pubkey: &str) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { query_as!( Self, @@ -458,11 +462,9 @@ impl Device { ) -> Result, SqlxError> { if let Some(device_id) = self.id { let result = query!( - r#" - SELECT wireguard_ip - FROM wireguard_network_device - WHERE device_id = $1 AND wireguard_network_id = $2 - "#, + "SELECT wireguard_ip \ + FROM wireguard_network_device \ + WHERE device_id = $1 AND wireguard_network_id = $2", device_id, network_id ) @@ -490,7 +492,6 @@ impl Device { pub async fn add_to_all_networks( &self, transaction: &mut PgConnection, - admin_group_name: &String, ) -> Result<(Vec, Vec), DeviceError> { info!("Adding device {} to all existing networks", self.name); let networks = WireguardNetwork::all(&mut *transaction).await?; @@ -527,7 +528,7 @@ impl Device { } if let Ok(wireguard_network_device) = network - .add_device_to_network(&mut *transaction, self, admin_group_name, None) + .add_device_to_network(&mut *transaction, self, None) .await { debug!( @@ -537,6 +538,8 @@ impl Device { let device_network_info = DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key.clone(), + is_authorized: wireguard_network_device.is_authorized, }; network_info.push(device_network_info); @@ -550,6 +553,8 @@ impl Device { allowed_ips: network.allowed_ips, pubkey: network.pubkey, dns: network.dns, + mfa_enabled: network.mfa_enabled, + keepalive_interval: network.keepalive_interval, }); } } @@ -561,7 +566,7 @@ impl Device { &self, transaction: &mut PgConnection, network: &WireguardNetwork, - reserved_ips: Option<&Vec>, + reserved_ips: Option<&[IpAddr]>, ) -> Result { let Some(network_id) = network.id else { return Err(ModelError::CannotCreate); @@ -654,11 +659,11 @@ mod test { network.save(&pool).await.unwrap(); let mut user = User::new( - "testuser".to_string(), + "testuser", Some("hunter2"), - "Tester".to_string(), - "Test".to_string(), - "test@test.com".to_string(), + "Tester", + "Test", + "test@test.com", None, ); user.save(&pool).await.unwrap(); diff --git a/src/db/models/enrollment.rs b/src/db/models/enrollment.rs index 5864071a3..2625a9ff3 100644 --- a/src/db/models/enrollment.rs +++ b/src/db/models/enrollment.rs @@ -1,3 +1,11 @@ +use chrono::{Duration, NaiveDateTime, Utc}; +use reqwest::Url; +use sqlx::{query, query_as, Error as SqlxError, PgConnection, PgExecutor}; +use tera::{Context, Tera}; +use thiserror::Error; +use tokio::sync::mpsc::UnboundedSender; +use tonic::{Code, Status}; + use super::{settings::Settings, DbPool, User}; use crate::{ mail::Mail, @@ -5,19 +13,15 @@ use crate::{ templates::{self, TemplateError}, SERVER_CONFIG, VERSION, }; -use chrono::{Duration, NaiveDateTime, Utc}; -use reqwest::Url; -use sqlx::{query, query_as, Error as SqlxError, PgConnection}; -use tera::{Context, Tera}; -use thiserror::Error; -use tokio::sync::mpsc::UnboundedSender; -use tonic::{Code, Status}; -const ENROLLMENT_START_MAIL_SUBJECT: &str = "Defguard user enrollment"; -const DESKTOP_START_MAIL_SUBJECT: &str = "Defguard desktop client configuration"; +pub static ENROLLMENT_TOKEN_TYPE: &str = "ENROLLMENT"; +pub static PASSWORD_RESET_TOKEN_TYPE: &str = "PASSWORD_RESET"; + +static ENROLLMENT_START_MAIL_SUBJECT: &str = "Defguard user enrollment"; +static DESKTOP_START_MAIL_SUBJECT: &str = "Defguard desktop client configuration"; #[derive(Error, Debug)] -pub enum EnrollmentError { +pub enum TokenError { #[error(transparent)] DbError(#[from] SqlxError), #[error("Enrollment token not found")] @@ -46,23 +50,23 @@ pub enum EnrollmentError { TemplateError(#[from] TemplateError), } -impl From for Status { - fn from(err: EnrollmentError) -> Self { - error!("{}", err); +impl From for Status { + fn from(err: TokenError) -> Self { + error!("{err}"); let (code, msg) = match err { - EnrollmentError::DbError(_) - | EnrollmentError::AdminNotFound - | EnrollmentError::UserNotFound - | EnrollmentError::NotificationError(_) - | EnrollmentError::WelcomeMsgNotConfigured - | EnrollmentError::WelcomeEmailNotConfigured - | EnrollmentError::TemplateError(_) - | EnrollmentError::TemplateErrorInternal(_) => (Code::Internal, "unexpected error"), - EnrollmentError::NotFound - | EnrollmentError::TokenExpired - | EnrollmentError::SessionExpired - | EnrollmentError::TokenUsed => (Code::Unauthenticated, "invalid token"), - EnrollmentError::AlreadyActive => (Code::InvalidArgument, "already active"), + TokenError::DbError(_) + | TokenError::AdminNotFound + | TokenError::UserNotFound + | TokenError::NotificationError(_) + | TokenError::WelcomeMsgNotConfigured + | TokenError::WelcomeEmailNotConfigured + | TokenError::TemplateError(_) + | TokenError::TemplateErrorInternal(_) => (Code::Internal, "unexpected error"), + TokenError::NotFound + | TokenError::TokenExpired + | TokenError::SessionExpired + | TokenError::TokenUsed => (Code::Unauthenticated, "invalid token"), + TokenError::AlreadyActive => (Code::InvalidArgument, "already active"), }; Status::new(code, msg) } @@ -70,23 +74,25 @@ impl From for Status { // Representation of a user enrollment session #[derive(Clone)] -pub struct Enrollment { +pub struct Token { pub id: String, pub user_id: i64, - pub admin_id: i64, + pub admin_id: Option, pub email: Option, pub created_at: NaiveDateTime, pub expires_at: NaiveDateTime, pub used_at: Option, + pub token_type: Option, } -impl Enrollment { +impl Token { #[must_use] pub fn new( user_id: i64, - admin_id: i64, + admin_id: Option, email: Option, token_timeout_seconds: u64, + token_type: Option, ) -> Self { let now = Utc::now(); Self { @@ -97,13 +103,14 @@ impl Enrollment { created_at: now.naive_utc(), expires_at: (now + Duration::seconds(token_timeout_seconds as i64)).naive_utc(), used_at: None, + token_type, } } - pub async fn save(&self, transaction: &mut PgConnection) -> Result<(), EnrollmentError> { + pub async fn save(&self, transaction: &mut PgConnection) -> Result<(), TokenError> { query!( - "INSERT INTO enrollment (id, user_id, admin_id, email, created_at, expires_at, used_at) \ - VALUES ($1, $2, $3, $4, $5, $6, $7)", + "INSERT INTO token (id, user_id, admin_id, email, created_at, expires_at, used_at, token_type) \ + VALUES ($1, $2, $3, $4, $5, $6, $7, $8)", self.id, self.user_id, self.admin_id, @@ -111,6 +118,7 @@ impl Enrollment { self.created_at, self.expires_at, self.used_at, + self.token_type, ) .execute(transaction) .await?; @@ -147,87 +155,85 @@ impl Enrollment { &mut self, transaction: &mut PgConnection, session_timeout_seconds: u64, - ) -> Result { + ) -> Result { // check if token can be used if self.is_expired() { - return Err(EnrollmentError::TokenExpired); + return Err(TokenError::TokenExpired); } if self.is_used() { - return Err(EnrollmentError::TokenUsed); + return Err(TokenError::TokenUsed); } let now = Utc::now().naive_utc(); - query!( - "UPDATE enrollment SET used_at = $1 WHERE id = $2", - now, - self.id - ) - .execute(transaction) - .await?; + query!("UPDATE token SET used_at = $1 WHERE id = $2", now, self.id) + .execute(transaction) + .await?; self.used_at = Some(now); Ok(now + Duration::seconds(session_timeout_seconds as i64)) } - pub async fn find_by_id(pool: &DbPool, id: &str) -> Result { + pub async fn find_by_id(pool: &DbPool, id: &str) -> Result { match query_as!( Self, - "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at \ - FROM enrollment WHERE id = $1", + "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at, token_type \ + FROM token WHERE id = $1", id ) .fetch_optional(pool) .await? { Some(enrollment) => Ok(enrollment), - None => Err(EnrollmentError::NotFound), + None => Err(TokenError::NotFound), } } - pub async fn fetch_all(pool: &DbPool) -> Result, EnrollmentError> { - let enrollments = query_as!( + pub async fn fetch_all(pool: &DbPool) -> Result, TokenError> { + let tokens = query_as!( Self, - "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at \ - FROM enrollment", + "SELECT id, user_id, admin_id, email, created_at, expires_at, used_at, token_type \ + FROM token", ) .fetch_all(pool) .await?; - Ok(enrollments) + Ok(tokens) } - pub async fn fetch_user<'e, E>(&self, executor: E) -> Result + pub async fn fetch_user<'e, E>(&self, executor: E) -> Result where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { debug!("Fetching user for enrollment"); let Some(user) = User::find_by_id(executor, self.user_id).await? else { error!("User not found for enrollment token {}", self.id); - return Err(EnrollmentError::UserNotFound); + return Err(TokenError::UserNotFound); }; Ok(user) } - pub async fn fetch_admin<'e, E>(&self, executor: E) -> Result + pub async fn fetch_admin<'e, E>(&self, executor: E) -> Result, TokenError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { debug!("Fetching admin for enrollment"); - let Some(user) = User::find_by_id(executor, self.admin_id).await? else { - error!("Admin not found for enrollment token {}", self.id); - return Err(EnrollmentError::AdminNotFound); - }; + if self.admin_id.is_none() { + return Ok(None); + } + + let admin_id = self.admin_id.unwrap(); + let user = User::find_by_id(executor, admin_id).await?; Ok(user) } pub async fn delete_unused_user_tokens( transaction: &mut PgConnection, user_id: i64, - ) -> Result<(), EnrollmentError> { + ) -> Result<(), TokenError> { debug!("Deleting unused enrollment tokens for user {user_id}"); let result = query!( - r#"DELETE FROM enrollment - WHERE user_id = $1 - AND used_at IS NULL"#, + "DELETE FROM token \ + WHERE user_id = $1 \ + AND used_at IS NULL", user_id ) .execute(transaction) @@ -240,6 +246,28 @@ impl Enrollment { Ok(()) } + pub async fn delete_unused_user_password_reset_tokens( + transaction: &mut PgConnection, + user_id: i64, + ) -> Result<(), TokenError> { + debug!("Deleting unused password reset tokens for user {user_id}"); + let result = query!( + "DELETE FROM token \ + WHERE user_id = $1 \ + AND token_type = 'PASSWORD_RESET' \ + AND used_at IS NULL", + user_id + ) + .execute(transaction) + .await?; + debug!( + "Deleted {} unused password reset tokens for user {user_id}", + result.rows_affected() + ); + + Ok(()) + } + /// Prepare context for rendering welcome messages /// Available tags include: /// - first_name @@ -254,7 +282,7 @@ impl Enrollment { pub async fn get_welcome_message_context( &self, transaction: &mut PgConnection, - ) -> Result { + ) -> Result { debug!( "Preparing welcome message context for enrollment token {}", self.id @@ -269,10 +297,13 @@ impl Enrollment { context.insert("username", &user.username); context.insert("defguard_url", &SERVER_CONFIG.get().unwrap().url); context.insert("defguard_version", &VERSION); - context.insert("admin_first_name", &admin.first_name); - context.insert("admin_last_name", &admin.last_name); - context.insert("admin_email", &admin.email); - context.insert("admin_phone", &admin.phone); + + if let Some(admin) = admin { + context.insert("admin_first_name", &admin.first_name); + context.insert("admin_last_name", &admin.last_name); + context.insert("admin_email", &admin.email); + context.insert("admin_phone", &admin.phone); + } Ok(context) } @@ -282,7 +313,7 @@ impl Enrollment { pub async fn get_welcome_page_content( &self, transaction: &mut PgConnection, - ) -> Result { + ) -> Result { let settings = Settings::get_settings(&mut *transaction).await?; // load configured content as template @@ -298,9 +329,9 @@ impl Enrollment { pub async fn get_welcome_email_content( &self, transaction: &mut PgConnection, - ip_address: String, - device_info: Option, - ) -> Result { + ip_address: &str, + device_info: Option<&str>, + ) -> Result { let settings = Settings::get_settings(&mut *transaction).await?; // load configured content as template @@ -331,13 +362,13 @@ impl User { enrollment_service_url: Url, send_user_notification: bool, mail_tx: UnboundedSender, - ) -> Result { + ) -> Result { info!( "User {} starting enrollment for user {}, notification enabled: {send_user_notification}", admin.username, self.username ); if self.has_password() { - return Err(EnrollmentError::AlreadyActive); + return Err(TokenError::AlreadyActive); } let user_id = self.id.expect("User without ID"); @@ -346,7 +377,13 @@ impl User { self.clear_unused_enrollment_tokens(&mut *transaction) .await?; - let enrollment = Enrollment::new(user_id, admin_id, email.clone(), token_timeout_seconds); + let enrollment = Token::new( + user_id, + Some(admin_id), + email.clone(), + token_timeout_seconds, + Some(ENROLLMENT_TOKEN_TYPE.to_string()), + ); enrollment.save(&mut *transaction).await?; if send_user_notification { @@ -366,7 +403,7 @@ impl User { enrollment_service_url, &enrollment.id, ) - .map_err(|err| EnrollmentError::NotificationError(err.to_string()))?, + .map_err(|err| TokenError::NotificationError(err.to_string()))?, attachments: Vec::new(), result_tx: None, }; @@ -379,7 +416,7 @@ impl User { } Err(err) => { error!("Error sending mail: {err}"); - return Err(EnrollmentError::NotificationError(err.to_string())); + return Err(TokenError::NotificationError(err.to_string())); } } } @@ -399,7 +436,7 @@ impl User { enrollment_service_url: Url, send_user_notification: bool, mail_tx: UnboundedSender, - ) -> Result { + ) -> Result { info!( "User {} starting desktop configuration for user {}, notification enabled: {send_user_notification}", admin.username, self.username @@ -411,7 +448,13 @@ impl User { self.clear_unused_enrollment_tokens(&mut *transaction) .await?; - let enrollment = Enrollment::new(user_id, admin_id, email.clone(), token_timeout_seconds); + let enrollment = Token::new( + user_id, + Some(admin_id), + email.clone(), + token_timeout_seconds, + Some(ENROLLMENT_TOKEN_TYPE.to_string()), + ); enrollment.save(&mut *transaction).await?; if send_user_notification { @@ -431,7 +474,7 @@ impl User { &enrollment_service_url, &enrollment.id, ) - .map_err(|err| EnrollmentError::NotificationError(err.to_string()))?, + .map_err(|err| TokenError::NotificationError(err.to_string()))?, attachments: Vec::new(), result_tx: None, }; @@ -456,30 +499,43 @@ impl User { async fn clear_unused_enrollment_tokens( &self, transaction: &mut PgConnection, - ) -> Result<(), EnrollmentError> { + ) -> Result<(), TokenError> { info!( "Removing unused enrollment tokens for user {}", self.username ); - Enrollment::delete_unused_user_tokens(transaction, self.id.expect("Missing user ID")).await + Token::delete_unused_user_tokens(transaction, self.id.expect("Missing user ID")).await } + + // pub async fn request_password_reset( + // &self, + // transaction: &mut PgConnection, + // admin: &User, + // // email: Option, + // token_timeout_seconds: u64, + // // enrollment_service_url: Url, + // // send_user_notification: bool, + // mail_tx: UnboundedSender, + // ) -> Result { + + // } } impl Settings { - pub fn enrollment_welcome_message(&self) -> Result { + pub fn enrollment_welcome_message(&self) -> Result { self.enrollment_welcome_message.clone().ok_or_else(|| { error!("Enrollment welcome message not configured"); - EnrollmentError::WelcomeMsgNotConfigured + TokenError::WelcomeMsgNotConfigured }) } - pub fn enrollment_welcome_email(&self) -> Result { + pub fn enrollment_welcome_email(&self) -> Result { if self.enrollment_use_welcome_message_as_email { return self.enrollment_welcome_message(); } self.enrollment_welcome_email.clone().ok_or_else(|| { error!("Enrollment welcome email not configured"); - EnrollmentError::WelcomeEmailNotConfigured + TokenError::WelcomeEmailNotConfigured }) } } diff --git a/src/db/models/group.rs b/src/db/models/group.rs index bc42d00f3..2df043620 100644 --- a/src/db/models/group.rs +++ b/src/db/models/group.rs @@ -1,9 +1,9 @@ use model_derive::Model; -use sqlx::{query, query_as, query_scalar, Error as SqlxError, PgConnection}; +use sqlx::{query, query_as, query_scalar, Error as SqlxError, PgConnection, PgExecutor}; use crate::{ db::{models::error::ModelError, User, WireguardNetwork}, - DbPool, + SERVER_CONFIG, }; #[derive(Model)] @@ -14,7 +14,7 @@ pub struct Group { impl Group { #[must_use] - pub fn new(name: &str) -> Self { + pub fn new>(name: S) -> Self { Self { id: None, name: name.into(), @@ -23,7 +23,7 @@ impl Group { pub async fn find_by_name<'e, E>(executor: E, name: &str) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { query_as!( Self, @@ -34,21 +34,27 @@ impl Group { .await } - pub async fn member_usernames(&self, pool: &DbPool) -> Result, SqlxError> { + pub async fn member_usernames<'e, E>(&self, executor: E) -> Result, SqlxError> + where + E: PgExecutor<'e>, + { if let Some(id) = self.id { query_scalar!( "SELECT \"user\".username FROM \"user\" JOIN group_user ON \"user\".id = group_user.user_id \ WHERE group_user.group_id = $1", id ) - .fetch_all(pool) + .fetch_all(executor) .await } else { Ok(Vec::new()) } } - pub async fn fetch_all_members(&self, pool: &DbPool) -> Result, SqlxError> { + pub async fn members<'e, E>(&self, executor: E) -> Result, SqlxError> + where + E: PgExecutor<'e>, + { if let Some(id) = self.id { query_as!( User, @@ -60,7 +66,7 @@ impl Group { WHERE group_user.group_id = $1", id ) - .fetch_all(pool) + .fetch_all(executor) .await } else { Ok(Vec::new()) @@ -72,16 +78,12 @@ impl WireguardNetwork { /// Fetch a list of all allowed groups for a given network from DB pub async fn fetch_allowed_groups<'e, E>(&self, executor: E) -> Result, ModelError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { - debug!("Fetching all allowed groups for network {}", self); + debug!("Fetching all allowed groups for network {self}"); let groups = query_scalar!( - r#" - SELECT name - FROM wireguard_network_allowed_group wag - JOIN "group" g ON wag.group_id = g.id - WHERE wag.network_id = $1 - "#, + "SELECT name FROM wireguard_network_allowed_group wag \ + JOIN \"group\" g ON wag.group_id = g.id WHERE wag.network_id = $1", self.id ) .fetch_all(executor) @@ -98,20 +100,23 @@ impl WireguardNetwork { pub async fn get_allowed_groups( &self, transaction: &mut PgConnection, - admin_group_name: &String, ) -> Result>, ModelError> { - debug!("Returning a list of allowed groups for network {}", self); + debug!("Returning a list of allowed groups for network {self}"); + let admin_group_name = &SERVER_CONFIG + .get() + .expect("defguard config not found") + .admin_groupname; // get allowed groups from DB let mut groups = self.fetch_allowed_groups(&mut *transaction).await?; - // if no allowed groups are set then all group are allowed + // if no allowed groups are set then all groups are allowed if groups.is_empty() { return Ok(None); } // make sure admin group is included - if !groups.contains(admin_group_name) { - groups.push(admin_group_name.clone()); + if !groups.iter().any(|name| name == admin_group_name) { + groups.push(admin_group_name.to_string()); } Ok(Some(groups)) @@ -123,7 +128,7 @@ impl WireguardNetwork { transaction: &mut PgConnection, allowed_groups: Vec, ) -> Result<(), ModelError> { - info!("Setting allowed groups for network {}", self); + info!("Setting allowed groups for network {self}"); if allowed_groups.is_empty() { return self.clear_allowed_groups(transaction).await; } @@ -152,14 +157,10 @@ impl WireguardNetwork { transaction: &mut PgConnection, group: &str, ) -> Result<(), ModelError> { - info!("Adding allowed group {} for network {}", group, self); + info!("Adding allowed group {group} for network {self}"); query!( - r#" - INSERT INTO wireguard_network_allowed_group (network_id, group_id) - SELECT $1, g.id - FROM "group" g - WHERE g.name = $2 - "#, + "INSERT INTO wireguard_network_allowed_group (network_id, group_id) \ + SELECT $1, g.id FROM \"group\" g WHERE g.name = $2", self.id, group ) @@ -173,32 +174,28 @@ impl WireguardNetwork { transaction: &mut PgConnection, groups: Vec, ) -> Result<(), ModelError> { - info!("Removing allowed groups {:?} for network {}", groups, self); + info!("Removing allowed groups {groups:?} for network {self}"); let result = query!( - r#" - DELETE FROM wireguard_network_allowed_group - WHERE network_id = $1 AND group_id IN ( - SELECT id - FROM "group" - WHERE name IN (SELECT * FROM UNNEST($2::text[])) - ) - "#, + "DELETE FROM wireguard_network_allowed_group \ + WHERE network_id = $1 AND group_id IN ( \ + SELECT id FROM \"group\" \ + WHERE name IN (SELECT * FROM UNNEST($2::text[])) \ + )", self.id, &groups ) .execute(transaction) .await?; info!( - "Removed {} allowed groups for network {}", + "Removed {} allowed groups for network {self}", result.rows_affected(), - self ); Ok(()) } /// Remove all allowed groups for a given network async fn clear_allowed_groups(&self, transaction: &mut PgConnection) -> Result<(), ModelError> { - info!("Removing all allowed groups for network {}", self); + info!("Removing all allowed groups for network {self}"); let result = query!( "DELETE FROM wireguard_network_allowed_group WHERE network_id=$1", self.id @@ -206,9 +203,8 @@ impl WireguardNetwork { .execute(transaction) .await?; info!( - "Removed {} allowed groups for network {}", + "Removed {} allowed groups for network {self}", result.rows_affected(), - self ); Ok(()) } @@ -217,7 +213,7 @@ impl WireguardNetwork { #[cfg(test)] mod test { use super::*; - use crate::db::User; + use crate::db::{DbPool, User}; #[sqlx::test] async fn test_group(pool: DbPool) { @@ -243,11 +239,11 @@ mod test { group.save(&pool).await.unwrap(); let mut user = User::new( - "hpotter".into(), + "hpotter", Some("pass123"), - "Potter".into(), - "Harry".into(), - "h.potter@hogwart.edu.uk".into(), + "Potter", + "Harry", + "h.potter@hogwart.edu.uk", None, ); user.save(&pool).await.unwrap(); diff --git a/src/db/models/mod.rs b/src/db/models/mod.rs index 22e5592a5..6e46502d9 100644 --- a/src/db/models/mod.rs +++ b/src/db/models/mod.rs @@ -19,12 +19,13 @@ pub mod webauthn; pub mod webhook; pub mod wireguard; +use sqlx::{query_as, Error as SqlxError, PgConnection}; + use self::{ device::UserDevice, user::{MFAMethod, User}, }; use super::{DbPool, Group}; -use sqlx::{query_as, Error as SqlxError, PgConnection}; #[cfg(feature = "openid")] #[derive(Deserialize, Serialize)] @@ -80,7 +81,7 @@ pub struct UserInfo { impl UserInfo { pub async fn from_user(pool: &DbPool, user: &User) -> Result { - let groups = user.member_of(pool).await?; + let groups = user.member_of_names(pool).await?; let authorized_apps = user.oauth2authorizedapps(pool).await?; Ok(Self { @@ -119,7 +120,10 @@ impl UserInfo { // add to groups if not already a member for groupname in &self.groups { - match present_groups.iter().position(|name| name == groupname) { + match present_groups + .iter() + .position(|group| &group.name == groupname) + { Some(index) => { present_groups.swap_remove(index); } @@ -133,11 +137,9 @@ impl UserInfo { } // remove from remaining groups - for groupname in present_groups { - if let Some(group) = Group::find_by_name(&mut *transaction, &groupname).await? { - user.remove_from_group(&mut *transaction, &group).await?; - groups_changed = true; - } + for group in present_groups { + user.remove_from_group(&mut *transaction, &group).await?; + groups_changed = true; } Ok(groups_changed) @@ -266,11 +268,11 @@ mod test { #[sqlx::test] async fn test_user_info(pool: DbPool) { let mut user = User::new( - "hpotter".into(), + "hpotter", Some("pass123"), - "Potter".into(), - "Harry".into(), - "h.potter@hogwart.edu.uk".into(), + "Potter", + "Harry", + "h.potter@hogwart.edu.uk", None, ); user.save(&pool).await.unwrap(); diff --git a/src/db/models/session.rs b/src/db/models/session.rs index 3fcb32063..d5db28a57 100644 --- a/src/db/models/session.rs +++ b/src/db/models/session.rs @@ -1,9 +1,10 @@ -use super::DbPool; -use crate::{auth::SESSION_TIMEOUT, random::gen_alphanumeric}; use chrono::{Duration, NaiveDateTime, Utc}; -use sqlx::{query, query_as, Error as SqlxError, Type}; +use sqlx::{query, query_as, Error as SqlxError, PgExecutor, Type}; use webauthn_rs::prelude::{PasskeyAuthentication, PasskeyRegistration}; +use super::DbPool; +use crate::{auth::SESSION_TIMEOUT, random::gen_alphanumeric}; + #[derive(Clone, PartialEq, Type)] #[repr(i16)] pub enum SessionState { @@ -110,66 +111,83 @@ impl Session { .and_then(|challenge| serde_cbor::from_slice(challenge).ok()) } - pub async fn set_passkey_authentication( + pub async fn set_passkey_authentication<'e, E>( &mut self, - pool: &DbPool, + executor: E, passkey_auth: &PasskeyAuthentication, - ) -> Result<(), SqlxError> { - let webauthn_challenge = serde_cbor::to_vec(passkey_auth).unwrap(); - query!( - "UPDATE session SET webauthn_challenge = $1 WHERE id = $2", - webauthn_challenge, - self.id - ) - .execute(pool) - .await?; - self.webauthn_challenge = Some(webauthn_challenge); + ) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { + if let Ok(webauthn_challenge) = serde_cbor::to_vec(passkey_auth) { + query!( + "UPDATE session SET webauthn_challenge = $1 WHERE id = $2", + webauthn_challenge, + self.id + ) + .execute(executor) + .await?; + self.webauthn_challenge = Some(webauthn_challenge); + } Ok(()) } - pub async fn set_passkey_registration( + pub async fn set_passkey_registration<'e, E>( &mut self, - pool: &DbPool, + executor: E, passkey_reg: &PasskeyRegistration, - ) -> Result<(), SqlxError> { - let webauthn_challenge = serde_cbor::to_vec(passkey_reg).unwrap(); - query!( - "UPDATE session SET webauthn_challenge = $1 WHERE id = $2", - webauthn_challenge, - self.id - ) - .execute(pool) - .await?; - self.webauthn_challenge = Some(webauthn_challenge); + ) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { + if let Ok(webauthn_challenge) = serde_cbor::to_vec(passkey_reg) { + query!( + "UPDATE session SET webauthn_challenge = $1 WHERE id = $2", + webauthn_challenge, + self.id + ) + .execute(executor) + .await?; + self.webauthn_challenge = Some(webauthn_challenge); + } Ok(()) } - pub async fn set_web3_challenge( + pub async fn set_web3_challenge<'e, E>( &mut self, - pool: &DbPool, + executor: E, web3_challenge: String, - ) -> Result<(), SqlxError> { + ) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { query!( "UPDATE session SET web3_challenge = $1 WHERE id = $2", web3_challenge, self.id ) - .execute(pool) + .execute(executor) .await?; self.web3_challenge = Some(web3_challenge); Ok(()) } - pub async fn delete(self, pool: &DbPool) -> Result<(), SqlxError> { + pub async fn delete<'e, E>(self, executor: E) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { query!("DELETE FROM session WHERE id = $1", self.id) - .execute(pool) + .execute(executor) .await?; Ok(()) } - pub async fn delete_expired(pool: &DbPool) -> Result<(), SqlxError> { + pub async fn delete_expired<'e, E>(executor: E) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { query!("DELETE FROM session WHERE expires < now()",) - .execute(pool) + .execute(executor) .await?; Ok(()) } diff --git a/src/db/models/settings.rs b/src/db/models/settings.rs index ebf2b9315..ed8257ba5 100644 --- a/src/db/models/settings.rs +++ b/src/db/models/settings.rs @@ -1,10 +1,12 @@ -use super::DbPool; -use crate::secret::SecretString; -use model_derive::Model; -use sqlx::{query, Error as SqlxError, Type}; use std::collections::HashMap; + +use model_derive::Model; +use sqlx::{query, query_as, Error as SqlxError, PgExecutor, Type}; use struct_patch::Patch; +use super::DbPool; +use crate::secret::SecretString; + #[derive(Clone, Deserialize, Serialize, PartialEq, Eq, Type, Debug)] #[sqlx(type_name = "smtp_encryption", rename_all = "lowercase")] pub enum SmtpEncryption { @@ -44,7 +46,7 @@ pub struct Settings { pub enrollment_welcome_email: Option, pub enrollment_welcome_email_subject: Option, pub enrollment_use_welcome_message_as_email: bool, - // Instance uuid needed for desktop client + // Instance UUID needed for desktop client #[serde(skip)] pub uuid: uuid::Uuid, // LDAP @@ -63,9 +65,9 @@ pub struct Settings { } impl Settings { - pub async fn get_settings<'e, E>(executor: E) -> Result + pub async fn get_settings<'e, E>(executor: E) -> Result where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { let settings = Settings::find_by_id(executor, 1).await?; @@ -75,7 +77,7 @@ impl Settings { // Set default values for settings if not set yet. // This is only relevant to a subset of settings which are nullable // and we want to initialize their values. - pub async fn init_defaults(pool: &DbPool) -> Result<(), sqlx::Error> { + pub async fn init_defaults(pool: &DbPool) -> Result<(), SqlxError> { info!("Initializing default settings"); let default_settings = HashMap::from([ @@ -98,6 +100,7 @@ impl Settings { /// Check if all required SMTP options are configured. /// /// Meant to be used to check if sending emails is enabled in current instance. + #[must_use] pub fn smtp_configured(&self) -> bool { self.smtp_server.is_some() && self.smtp_port.is_some() @@ -107,14 +110,7 @@ impl Settings { } } -#[derive(Debug, Serialize, Clone)] -pub struct SettingsBranding { - pub instance_name: String, - pub main_logo_url: String, - pub nav_logo_url: String, -} - -#[derive(Debug, Serialize, Clone)] +#[derive(Serialize)] pub struct SettingsEssentials { pub instance_name: String, pub main_logo_url: String, @@ -126,11 +122,18 @@ pub struct SettingsEssentials { } impl SettingsEssentials { - pub async fn get_settings_essentials(pool: &DbPool) -> Result { - let res = sqlx::query_as!(SettingsEssentials, r#" - SELECT instance_name, main_logo_url, nav_logo_url, wireguard_enabled, webhooks_enabled, worker_enabled, openid_enabled FROM settings WHERE id = 1; - "#).fetch_one(pool).await?; - Ok(res) + pub(crate) async fn get_settings_essentials<'e, E>(executor: E) -> Result + where + E: PgExecutor<'e>, + { + query_as!( + SettingsEssentials, + "SELECT instance_name, main_logo_url, nav_logo_url, wireguard_enabled, \ + webhooks_enabled, worker_enabled, openid_enabled \ + FROM settings WHERE id = 1" + ) + .fetch_one(executor) + .await } } @@ -149,7 +152,7 @@ impl From for SettingsEssentials { } mod defaults { - pub const WELCOME_MESSAGE: &str = "Dear {{ first_name }} {{ last_name }}, + pub static WELCOME_MESSAGE: &str = "Dear {{ first_name }} {{ last_name }}, By completing the enrollment process, you now have now access to all company systems. @@ -184,5 +187,5 @@ Sent by defguard {{ defguard_version }} Star us on GitHub! https://github.com/defguard/defguard\ "; - pub const WELCOME_EMAIL_SUBJECT: &str = "[defguard] Welcome message after enrollment"; + pub static WELCOME_EMAIL_SUBJECT: &str = "[defguard] Welcome message after enrollment"; } diff --git a/src/db/models/user.rs b/src/db/models/user.rs index 5745b308b..c50328434 100644 --- a/src/db/models/user.rs +++ b/src/db/models/user.rs @@ -1,12 +1,5 @@ -use super::{ - device::{Device, UserDevice}, - group::Group, - wallet::Wallet, - webauthn::WebAuthn, - DbPool, MFAInfo, OAuth2AuthorizedAppInfo, SecurityKey, WalletInfo, -}; -use crate::auth::EMAIL_CODE_VALIDITY_PERIOD; -use crate::{auth::TOTP_CODE_VALIDITY_PERIOD, error::WebError, random::gen_alphanumeric}; +use std::{string::ToString, time::SystemTime}; + use argon2::{ password_hash::{ errors::Error as HashError, rand_core::OsRng, PasswordHash, PasswordHasher, @@ -17,9 +10,20 @@ use argon2::{ use axum::http::StatusCode; use model_derive::Model; use otpauth::TOTP; -use rand::{thread_rng, Rng}; -use sqlx::{query, query_as, query_scalar, Error as SqlxError, Type}; -use std::time::SystemTime; +use sqlx::{query, query_as, query_scalar, Error as SqlxError, PgExecutor, Type}; + +use super::{ + device::{Device, UserDevice}, + group::Group, + wallet::Wallet, + webauthn::WebAuthn, + DbPool, MFAInfo, OAuth2AuthorizedAppInfo, SecurityKey, WalletInfo, +}; +use crate::{ + auth::{EMAIL_CODE_VALIDITY_PERIOD, TOTP_CODE_VALIDITY_PERIOD}, + error::WebError, + random::{gen_alphanumeric, gen_totp_secret}, +}; const RECOVERY_CODES_COUNT: usize = 8; @@ -33,7 +37,7 @@ pub enum MFAMethod { Email, } -impl std::string::ToString for MFAMethod { +impl ToString for MFAMethod { fn to_string(&self) -> String { match self { MFAMethod::None => "None".into(), @@ -46,7 +50,7 @@ impl std::string::ToString for MFAMethod { } // User information ready to be sent as part of diagnostic data. -#[derive(Debug, Serialize)] +#[derive(Serialize)] pub struct UserDiagnostic { pub id: i64, pub mfa_enabled: bool, @@ -89,24 +93,23 @@ impl User { } #[must_use] - pub fn new( - username: String, + pub fn new>( + username: S, password: Option<&str>, - last_name: String, - first_name: String, - email: String, + last_name: S, + first_name: S, + email: S, phone: Option, ) -> Self { - let password_hash = password.map(|password_hash| { - Self::hash_password(password_hash).expect("Failed to hash password") - }); + let password_hash = + password.and_then(|password_hash| Self::hash_password(password_hash).ok()); Self { id: None, - username, + username: username.into(), password_hash, - last_name, - first_name, - email, + last_name: last_name.into(), + first_name: first_name.into(), + email: email.into(), phone, ssh_key: None, pgp_key: None, @@ -122,7 +125,7 @@ impl User { } pub fn set_password(&mut self, password: &str) { - self.password_hash = Some(Self::hash_password(password).unwrap()); + self.password_hash = Self::hash_password(password).ok(); } pub fn verify_password(&self, password: &str) -> Result<(), HashError> { @@ -148,16 +151,19 @@ impl User { format!("{} {}", self.first_name, self.last_name) } - /// Generate new `secret`, save it, then return it as RFC 4648 base32-encoded string. - pub async fn new_totp_secret(&mut self, pool: &DbPool) -> Result { - let secret = thread_rng().gen::<[u8; 20]>().to_vec(); + /// Generate new TOTP secret, save it, then return it as RFC 4648 base32-encoded string. + pub async fn new_totp_secret<'e, E>(&mut self, executor: E) -> Result + where + E: PgExecutor<'e>, + { + let secret = gen_totp_secret(); if let Some(id) = self.id { query!( "UPDATE \"user\" SET totp_secret = $1 WHERE id = $2", secret, id ) - .execute(pool) + .execute(executor) .await?; } let secret_base32 = TOTP::from_bytes(&secret).base32_secret(); @@ -165,30 +171,36 @@ impl User { Ok(secret_base32) } - /// Generate new `secret` similar to TOTP secret above, but don't return generated value. - pub async fn new_email_secret(&mut self, pool: &DbPool) -> Result<(), SqlxError> { - let email_secret = thread_rng().gen::<[u8; 20]>().to_vec(); + /// Generate new email secret, similar to TOTP secret above, but don't return generated value. + pub async fn new_email_secret<'e, E>(&mut self, executor: E) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { + let email_secret = gen_totp_secret(); if let Some(id) = self.id { query!( "UPDATE \"user\" SET email_mfa_secret = $1 WHERE id = $2", email_secret, id ) - .execute(pool) + .execute(executor) .await?; } self.email_mfa_secret = Some(email_secret); Ok(()) } - pub async fn set_mfa_method( + pub async fn set_mfa_method<'e, E>( &mut self, - pool: &DbPool, + executor: E, mfa_method: MFAMethod, - ) -> Result<(), SqlxError> { + ) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { info!( - "Setting MFA method for user {} to {:?}", - self.username, mfa_method + "Setting MFA method for user {} to {mfa_method:?}", + self.username ); if let Some(id) = self.id { query!( @@ -196,7 +208,7 @@ impl User { id, &mfa_method as &MFAMethod ) - .execute(pool) + .execute(executor) .await?; } self.mfa_method = mfa_method; @@ -208,7 +220,10 @@ impl User { /// - TOTP is enabled /// - a [`Wallet`] flagged `use_for_mfa` /// - a security key for Webauthn - async fn check_mfa_enabled(&self, pool: &DbPool) -> Result { + async fn check_mfa_enabled<'e, E>(&self, executor: E) -> Result + where + E: PgExecutor<'e>, + { // short-cut if self.totp_enabled || self.email_mfa_enabled { return Ok(true); @@ -223,7 +238,7 @@ impl User { WHERE \"user\".id = $1 GROUP BY totp_enabled, email_mfa_enabled;", id ) - .fetch_one(pool) + .fetch_one(executor) .await } else { Ok(false) @@ -274,12 +289,12 @@ impl User { } Some(methods) => { info!( - "Checking if {:?} in in available methods {:?}, {}", + "Checking if {:?} in in available methods {methods:?}, {}", info.mfa_method, - methods, methods.contains(&info.mfa_method) ); if !methods.contains(&info.mfa_method) { + // FIXME: do not panic self.set_mfa_method(pool, methods.into_iter().next().unwrap()) .await?; } @@ -300,10 +315,13 @@ impl User { /// Get recovery codes. If recovery codes exist, this function returns `None`. /// That way recovery codes are returned only once - when MFA is turned on. - pub async fn get_recovery_codes( + pub async fn get_recovery_codes<'e, E>( &mut self, - pool: &DbPool, - ) -> Result>, SqlxError> { + executor: E, + ) -> Result>, SqlxError> + where + E: PgExecutor<'e>, + { if !self.recovery_codes.is_empty() { return Ok(None); } @@ -318,7 +336,7 @@ impl User { id, &self.recovery_codes ) - .execute(pool) + .execute(executor) .await?; } @@ -348,11 +366,14 @@ impl User { } /// Enable TOTP - pub async fn enable_totp(&mut self, pool: &DbPool) -> Result<(), SqlxError> { + pub async fn enable_totp<'e, E>(&mut self, executor: E) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { if !self.totp_enabled { if let Some(id) = self.id { query!("UPDATE \"user\" SET totp_enabled = TRUE WHERE id = $1", id) - .execute(pool) + .execute(executor) .await?; } self.totp_enabled = true; @@ -384,14 +405,17 @@ impl User { } /// Enable email MFA - pub async fn enable_email_mfa(&mut self, pool: &DbPool) -> Result<(), SqlxError> { + pub async fn enable_email_mfa<'e, E>(&mut self, executor: E) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { if !self.email_mfa_enabled { if let Some(id) = self.id { query!( "UPDATE \"user\" SET email_mfa_enabled = TRUE WHERE id = $1", id ) - .execute(pool) + .execute(executor) .await?; } self.email_mfa_enabled = true; @@ -427,9 +451,9 @@ impl User { pool: &DbPool, ) -> Result, SqlxError> { let users = query!( - r#" - SELECT id, mfa_enabled, totp_enabled, email_mfa_enabled, mfa_method as "mfa_method: MFAMethod", password_hash FROM "user" - "# + "SELECT id, mfa_enabled, totp_enabled, email_mfa_enabled, \ + mfa_method as \"mfa_method: MFAMethod\", password_hash \ + FROM \"user\"" ) .fetch_all(pool) .await?; @@ -535,10 +559,13 @@ impl User { } } - pub async fn find_by_username( - pool: &DbPool, + pub async fn find_by_username<'e, E>( + executor: E, username: &str, - ) -> Result, SqlxError> { + ) -> Result, SqlxError> + where + E: PgExecutor<'e>, + { query_as!( Self, "SELECT id \"id?\", username, password_hash, last_name, first_name, email, \ @@ -547,13 +574,29 @@ impl User { FROM \"user\" WHERE username = $1", username ) - .fetch_optional(pool) + .fetch_optional(executor) .await } - pub async fn member_of<'e, E>(&self, executor: E) -> Result, SqlxError> + pub async fn find_by_email<'e, E>(executor: E, email: &str) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, + { + query_as!( + Self, + "SELECT id \"id?\", username, password_hash, last_name, first_name, email, \ + phone, ssh_key, pgp_key, pgp_cert_id, mfa_enabled, totp_enabled, email_mfa_enabled, \ + totp_secret, email_mfa_secret, mfa_method \"mfa_method: _\", recovery_codes \ + FROM \"user\" WHERE email = $1", + email + ) + .fetch_optional(executor) + .await + } + + pub async fn member_of_names<'e, E>(&self, executor: E) -> Result, SqlxError> + where + E: PgExecutor<'e>, { if let Some(id) = self.id { query_scalar!( @@ -568,14 +611,30 @@ impl User { } } + pub async fn member_of<'e, E>(&self, executor: E) -> Result, SqlxError> + where + E: PgExecutor<'e>, + { + if let Some(id) = self.id { + query_as!( + Group, + "SELECT id \"id?\", name FROM \"group\" JOIN group_user ON \"group\".id = group_user.group_id \ + WHERE group_user.user_id = $1", + id + ) + .fetch_all(executor) + .await + } else { + Ok(Vec::new()) + } + } + pub async fn devices(&self, pool: &DbPool) -> Result, SqlxError> { if let Some(id) = self.id { let devices = query_as!( Device, - r#" - SELECT device.id "id?", name, wireguard_pubkey, user_id, created - FROM device WHERE user_id = $1 - "#, + "SELECT device.id \"id?\", name, wireguard_pubkey, user_id, created \ + FROM device WHERE user_id = $1", id ) .fetch_all(pool) @@ -593,7 +652,10 @@ impl User { } } - pub async fn wallets(&self, pool: &DbPool) -> Result, SqlxError> { + pub async fn wallets<'e, E>(&self, executor: E) -> Result, SqlxError> + where + E: PgExecutor<'e>, + { if let Some(id) = self.id { query_as!( WalletInfo, @@ -601,7 +663,7 @@ impl User { FROM wallet WHERE user_id = $1 AND validation_timestamp IS NOT NULL", id ) - .fetch_all(pool) + .fetch_all(executor) .await } else { Ok(Vec::new()) @@ -613,7 +675,7 @@ impl User { executor: E, ) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { if let Some(id) = self.id { query_as!( @@ -648,7 +710,7 @@ impl User { pub async fn add_to_group<'e, E>(&self, executor: E, group: &Group) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { if let (Some(id), Some(group_id)) = (self.id, group.id) { query!( @@ -669,7 +731,7 @@ impl User { group: &Group, ) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { if let (Some(id), Some(group_id)) = (self.id, group.id) { query!( @@ -683,14 +745,14 @@ impl User { Ok(()) } - // Remove authoirzed apps by their client id's from user + /// Remove authorized apps by their client id's from user pub async fn remove_oauth2_authorized_apps<'e, E>( &self, executor: E, - app_client_ids: &Vec, + app_client_ids: &[i64], ) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { if let Some(id) = self.id { query!( @@ -725,7 +787,7 @@ impl User { // if new user was created add them to admin group (ID 1) if let Some(new_user_id) = result { - info!("New admin user was created, adding to Admin group..."); + info!("New admin user has been created, adding to Admin group..."); query("INSERT INTO group_user (group_id, user_id) VALUES (1, $1)") .bind(new_user_id) .execute(pool) @@ -743,11 +805,11 @@ mod test { #[sqlx::test] async fn test_user(pool: DbPool) { let mut user = User::new( - "hpotter".into(), + "hpotter", Some("pass123"), - "Potter".into(), - "Harry".into(), - "h.potter@hogwart.edu.uk".into(), + "Potter", + "Harry", + "h.potter@hogwart.edu.uk", None, ); user.save(&pool).await.unwrap(); @@ -772,21 +834,21 @@ mod test { #[sqlx::test] async fn test_all_users(pool: DbPool) { let mut harry = User::new( - "hpotter".into(), + "hpotter", Some("pass123"), - "Potter".into(), - "Harry".into(), - "h.potter@hogwart.edu.uk".into(), + "Potter", + "Harry", + "h.potter@hogwart.edu.uk", None, ); harry.save(&pool).await.unwrap(); let mut albus = User::new( - "adumbledore".into(), + "adumbledore", Some("magic!"), - "Dumbledore".into(), - "Albus".into(), - "a.dumbledore@hogwart.edu.uk".into(), + "Dumbledore", + "Albus", + "a.dumbledore@hogwart.edu.uk", None, ); albus.save(&pool).await.unwrap(); @@ -803,11 +865,11 @@ mod test { #[sqlx::test] async fn test_recovery_codes(pool: DbPool) { let mut harry = User::new( - "hpotter".into(), + "hpotter", Some("pass123"), - "Potter".into(), - "Harry".into(), - "h.potter@hogwart.edu.uk".into(), + "Potter", + "Harry", + "h.potter@hogwart.edu.uk", None, ); harry.get_recovery_codes(&pool).await.unwrap(); diff --git a/src/db/models/wallet.rs b/src/db/models/wallet.rs index e64912bf6..e5de96e6f 100644 --- a/src/db/models/wallet.rs +++ b/src/db/models/wallet.rs @@ -1,5 +1,8 @@ -use super::DbPool; -use crate::hex::hex_decode; +use std::{ + error::Error, + fmt::{Display, Formatter, Result as FmtResult}, +}; + use chrono::{NaiveDateTime, Utc}; use ethers_core::types::transaction::eip712::{Eip712, TypedData}; use model_derive::Model; @@ -8,13 +11,12 @@ use secp256k1::{ ecdsa::{RecoverableSignature, RecoveryId}, Message, Secp256k1, }; -use sqlx::{query, query_as, Error as SqlxError}; -use std::{ - error::Error, - fmt::{Display, Formatter, Result as FmtResult}, -}; +use sqlx::{query, query_as, Error as SqlxError, PgExecutor}; use tiny_keccak::{Hasher, Keccak}; +use super::DbPool; +use crate::hex::hex_decode; + #[derive(Debug)] pub enum Web3Error { Decode, @@ -75,20 +77,20 @@ pub struct Wallet { impl Wallet { #[must_use] - pub fn new_for_user( + pub fn new_for_user>( user_id: i64, - address: String, - name: String, + address: S, + name: S, chain_id: i64, - challenge_message: String, + challenge_message: S, ) -> Self { Self { id: None, user_id, - address, - name, + address: address.into(), + name: name.into(), chain_id, - challenge_message, + challenge_message: challenge_message.into(), challenge_signature: None, creation_timestamp: Utc::now().naive_utc(), validation_timestamp: None, @@ -182,11 +184,14 @@ impl Wallet { .collect() } - pub async fn find_by_user_and_address( - pool: &DbPool, + pub async fn find_by_user_and_address<'e, E>( + executor: E, user_id: i64, address: &str, - ) -> Result, SqlxError> { + ) -> Result, SqlxError> + where + E: PgExecutor<'e>, + { query_as!( Self, "SELECT id \"id?\", user_id, address, name, chain_id, challenge_message, challenge_signature, \ @@ -195,16 +200,19 @@ impl Wallet { user_id, address ) - .fetch_optional(pool) + .fetch_optional(executor) .await } - pub async fn disable_mfa_for_user(pool: &DbPool, user_id: i64) -> Result<(), SqlxError> { + pub async fn disable_mfa_for_user<'e, E>(executor: E, user_id: i64) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { query!( "UPDATE wallet SET use_for_mfa = FALSE WHERE user_id = $1", user_id ) - .execute(pool) + .execute(executor) .await?; Ok(()) } diff --git a/src/db/models/webauthn.rs b/src/db/models/webauthn.rs index 96da7d2b3..2a7bbfe62 100644 --- a/src/db/models/webauthn.rs +++ b/src/db/models/webauthn.rs @@ -1,8 +1,9 @@ -use super::{error::ModelError, DbPool}; use model_derive::Model; -use sqlx::{query, query_as, query_scalar, Error as SqlxError}; +use sqlx::{query, query_as, query_scalar, Error as SqlxError, PgExecutor}; use webauthn_rs::prelude::Passkey; +use super::{error::ModelError, DbPool}; + #[derive(Model)] pub struct WebAuthn { id: Option, @@ -55,9 +56,12 @@ impl WebAuthn { } /// Delete all for a given user. - pub async fn delete_all_for_user(pool: &DbPool, user_id: i64) -> Result<(), SqlxError> { + pub async fn delete_all_for_user<'e, E>(executor: E, user_id: i64) -> Result<(), SqlxError> + where + E: PgExecutor<'e>, + { query!("DELETE FROM webauthn WHERE user_id = $1", user_id) - .execute(pool) + .execute(executor) .await?; Ok(()) } diff --git a/src/db/models/wireguard.rs b/src/db/models/wireguard.rs index 83547ac70..03417c114 100644 --- a/src/db/models/wireguard.rs +++ b/src/db/models/wireguard.rs @@ -1,3 +1,19 @@ +use std::{ + collections::HashMap, + fmt::{Debug, Display, Formatter}, + net::{IpAddr, Ipv4Addr}, + str::FromStr, +}; + +use base64::prelude::{Engine, BASE64_STANDARD}; +use chrono::{Duration, NaiveDateTime, Utc}; +use ipnetwork::{IpNetwork, IpNetworkError, NetworkSize}; +use model_derive::Model; +use rand_core::OsRng; +use sqlx::{query_as, query_scalar, Error as SqlxError, FromRow, PgConnection, PgExecutor}; +use thiserror::Error; +use x25519_dalek::{PublicKey, StaticSecret}; + use super::{ device::{Device, DeviceError, DeviceInfo, DeviceNetworkInfo, WireguardNetworkDevice}, error::ModelError, @@ -8,6 +24,9 @@ use crate::{ wg_config::ImportedDevice, }; +pub const DEFAULT_KEEPALIVE_INTERVAL: i32 = 25; +pub const DEFAULT_DISCONNECT_THRESHOLD: i32 = 25; + // Used in process of importing network from wireguard config #[derive(Debug, Clone, Deserialize, Serialize)] pub struct MappedDevice { @@ -17,21 +36,6 @@ pub struct MappedDevice { pub wireguard_ip: IpAddr, } -use base64::prelude::{Engine, BASE64_STANDARD}; -use chrono::{Duration, NaiveDateTime, Utc}; -use ipnetwork::{IpNetwork, IpNetworkError, NetworkSize}; -use model_derive::Model; -use rand_core::OsRng; -use sqlx::{query_as, query_scalar, Error as SqlxError, FromRow, PgConnection}; -use std::{ - collections::HashMap, - fmt::{Debug, Display, Formatter}, - net::{IpAddr, Ipv4Addr}, - str::FromStr, -}; -use thiserror::Error; -use x25519_dalek::{PublicKey, StaticSecret}; - pub static WIREGUARD_MAX_HANDSHAKE_MINUTES: u32 = 5; pub static PEER_STATS_LIMIT: i64 = 6 * 60; @@ -61,7 +65,7 @@ pub enum GatewayEvent { DeviceDeleted(DeviceInfo), } -/// Stores configuration required to setup a wireguard network +/// Stores configuration required to setup a WireGuard network #[derive(Clone, Debug, Model, Deserialize, Serialize, PartialEq)] #[table(wireguard_network)] pub struct WireguardNetwork { @@ -78,6 +82,9 @@ pub struct WireguardNetwork { #[model(ref)] pub allowed_ips: Vec, pub connected_at: Option, + pub mfa_enabled: bool, + pub keepalive_interval: i32, + pub peer_disconnect_threshold: i32, } pub struct WireguardKey { @@ -122,6 +129,9 @@ impl WireguardNetwork { endpoint: String, dns: Option, allowed_ips: Vec, + mfa_enabled: bool, + keepalive_interval: i32, + peer_disconnect_threshold: i32, ) -> Result { let prvkey = StaticSecret::random_from_rng(OsRng); let pubkey = PublicKey::from(&prvkey); @@ -136,6 +146,9 @@ impl WireguardNetwork { dns, allowed_ips, connected_at: None, + mfa_enabled, + keepalive_interval, + peer_disconnect_threshold, }) } @@ -149,11 +162,14 @@ impl WireguardNetwork { name: &str, ) -> Result>, WireguardNetworkError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { let networks = query_as!( WireguardNetwork, - r#"SELECT id as "id?", name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, connected_at FROM wireguard_network WHERE name = $1"#, + "SELECT \ + id as \"id?\", name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, \ + connected_at, mfa_enabled, keepalive_interval, peer_disconnect_threshold \ + FROM wireguard_network WHERE name = $1", name ) .fetch_all(executor) @@ -199,7 +215,7 @@ impl WireguardNetwork { Ok(()) } - /// Utility method to create wireguard keypair + /// Utility method to create WireGuard keypair #[must_use] pub fn genkey() -> WireguardKey { let private = StaticSecret::random_from_rng(OsRng); @@ -286,29 +302,26 @@ impl WireguardNetwork { async fn get_allowed_devices( &self, transaction: &mut PgConnection, - admin_group_name: &String, ) -> Result, ModelError> { debug!("Fetching all allowed devices for network {}", self); let devices = match self - .get_allowed_groups(&mut *transaction, admin_group_name) + .get_allowed_groups(&mut *transaction) .await? { // devices need to be filtered by allowed group Some(allowed_groups) => { query_as!( - Device, - r#" - SELECT DISTINCT ON (d.id) d.id as "id?", d.name, d.wireguard_pubkey, d.user_id, d.created - FROM device d - JOIN "user" u ON d.user_id = u.id - JOIN group_user gu ON u.id = gu.user_id - JOIN "group" g ON gu.group_id = g.id - WHERE g."name" IN (SELECT * FROM UNNEST($1::text[])) - ORDER BY d.id ASC - "#, - &allowed_groups - ) - .fetch_all(&mut *transaction) - .await? + Device, + "SELECT DISTINCT ON (d.id) d.id as \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created \ + FROM device d \ + JOIN \"user\" u ON d.user_id = u.id \ + JOIN group_user gu ON u.id = gu.user_id \ + JOIN \"group\" g ON gu.group_id = g.id \ + WHERE g.\"name\" IN (SELECT * FROM UNNEST($1::text[])) + ORDER BY d.id ASC", + &allowed_groups + ) + .fetch_all(&mut *transaction) + .await? }, // all devices are allowed None => { @@ -324,15 +337,12 @@ impl WireguardNetwork { pub async fn add_all_allowed_devices( &self, transaction: &mut PgConnection, - admin_group_name: &String, ) -> Result<(), ModelError> { info!( "Assigning IPs in network {} for all existing devices ", self ); - let devices = self - .get_allowed_devices(&mut *transaction, admin_group_name) - .await?; + let devices = self.get_allowed_devices(&mut *transaction).await?; for device in devices { device .assign_network_ip(&mut *transaction, self, None) @@ -346,13 +356,10 @@ impl WireguardNetwork { &self, transaction: &mut PgConnection, device: &Device, - admin_group_name: &String, - reserved_ips: Option<&Vec>, + reserved_ips: Option<&[IpAddr]>, ) -> Result { info!("Assigning IP in network {self} for {device}"); - let allowed_devices = self - .get_allowed_devices(&mut *transaction, admin_group_name) - .await?; + let allowed_devices = self.get_allowed_devices(&mut *transaction).await?; let allowed_device_ids: Vec = allowed_devices.iter().filter_map(|dev| dev.id).collect(); if allowed_device_ids.contains(&device.get_id()?) { @@ -361,7 +368,7 @@ impl WireguardNetwork { .await?; Ok(wireguard_network_device) } else { - error!("Device {} not allowed in network {}", device, self); + error!("Device {device} not allowed in network {self}"); Err(WireguardNetworkError::DeviceNotAllowed(format!( "{}", device @@ -375,17 +382,11 @@ impl WireguardNetwork { pub async fn sync_allowed_devices( &self, transaction: &mut PgConnection, - admin_group_name: &String, - reserved_ips: Option<&Vec>, + reserved_ips: Option<&[IpAddr]>, ) -> Result, WireguardNetworkError> { - info!( - "Synchronizing IPs in network {} for all allowed devices ", - self - ); + info!("Synchronizing IPs in network {self} for all allowed devices "); // list all allowed devices - let allowed_devices = self - .get_allowed_devices(&mut *transaction, admin_group_name) - .await?; + let allowed_devices = self.get_allowed_devices(&mut *transaction).await?; // convert to a map for easier processing let mut allowed_devices: HashMap = allowed_devices .into_iter() @@ -418,6 +419,8 @@ impl WireguardNetwork { network_info: vec![DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key, + is_authorized: wireguard_network_device.is_authorized, }], })); } @@ -436,11 +439,13 @@ impl WireguardNetwork { network_info: vec![DeviceNetworkInfo { network_id, device_wireguard_ip: device_network_config.wireguard_ip, + preshared_key: device_network_config.preshared_key, + is_authorized: device_network_config.is_authorized, }], })); } else { let msg = format!("Device {} does not exist", device_network_config.device_id); - error!("{msg}"); + error!(msg); return Err(WireguardNetworkError::Unexpected(msg)); } } @@ -456,6 +461,8 @@ impl WireguardNetwork { network_info: vec![DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key, + is_authorized: wireguard_network_device.is_authorized, }], })); } @@ -466,17 +473,14 @@ impl WireguardNetwork { /// Check if devices found in an imported config file exist already, /// if they do assign a specified IP. /// Return a list of imported devices which need to be manually mapped to a user - /// and a list of wireguard events to be sent out. + /// and a list of WireGuard events to be sent out. pub async fn handle_imported_devices( &self, transaction: &mut PgConnection, imported_devices: Vec, - admin_group_name: &String, ) -> Result<(Vec, Vec), WireguardNetworkError> { let network_id = self.get_id()?; - let allowed_devices = self - .get_allowed_devices(&mut *transaction, admin_group_name) - .await?; + let allowed_devices = self.get_allowed_devices(&mut *transaction).await?; // convert to a map for easier processing let allowed_devices: HashMap = allowed_devices .into_iter() @@ -514,6 +518,8 @@ impl WireguardNetwork { network_info: vec![DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key, + is_authorized: wireguard_network_device.is_authorized, }], })); } @@ -536,14 +542,11 @@ impl WireguardNetwork { &self, transaction: &mut PgConnection, mapped_devices: Vec, - admin_group_name: &String, ) -> Result, WireguardNetworkError> { info!("Mapping user devices for network {}", self); let network_id = self.get_id()?; // get allowed groups for network - let allowed_groups = self - .get_allowed_groups(&mut *transaction, admin_group_name) - .await?; + let allowed_groups = self.get_allowed_groups(&mut *transaction).await?; let mut events = Vec::new(); // use a helper hashmap to avoid repeated queries @@ -561,7 +564,7 @@ impl WireguardNetwork { mapped_device.user_id, ); device.save(&mut *transaction).await?; - debug!("Saved new device {}", device); + debug!("Saved new device {device}"); // get a list of groups user is assigned to let groups = match user_groups.get(&device.user_id) { @@ -570,9 +573,9 @@ impl WireguardNetwork { // fetch user info None => match User::find_by_id(&mut *transaction, device.user_id).await? { Some(user) => { - let groups = user.member_of(&mut *transaction).await?; + let groups = user.member_of_names(&mut *transaction).await?; user_groups.insert(device.user_id, groups); - // ugly workaround to get around `groups` being dropped + // FIXME: ugly workaround to get around `groups` being dropped user_groups.get(&device.user_id).unwrap() } None => return Err(WireguardNetworkError::from(ModelError::NotFound)), @@ -591,6 +594,8 @@ impl WireguardNetwork { network_info.push(DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key, + is_authorized: wireguard_network_device.is_authorized, }); } Some(allowed) => { @@ -606,15 +611,16 @@ impl WireguardNetwork { network_info.push(DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key, + is_authorized: wireguard_network_device.is_authorized, }); } } } // assign IPs in other networks - let (mut all_network_info, _configs) = device - .add_to_all_networks(&mut *transaction, admin_group_name) - .await?; + let (mut all_network_info, _configs) = + device.add_to_all_networks(&mut *transaction).await?; network_info.append(&mut all_network_info); @@ -636,14 +642,12 @@ impl WireguardNetwork { ) -> Result, SqlxError> { let stats = query_as!( WireguardPeerStats, - r#" - SELECT id "id?", device_id "device_id!", collected_at "collected_at!", network "network!", - endpoint, upload "upload!", download "download!", latest_handshake "latest_handshake!", allowed_ips - FROM wireguard_peer_stats - WHERE device_id = $1 AND network = $2 - ORDER BY collected_at DESC - LIMIT 1 - "#, + "SELECT id \"id?\", device_id \"device_id!\", collected_at \"collected_at!\", network \"network!\", \ + endpoint, upload \"upload!\", download \"download!\", latest_handshake \"latest_handshake!\", allowed_ips \ + FROM wireguard_peer_stats \ + WHERE device_id = $1 AND network = $2 \ + ORDER BY collected_at DESC \ + LIMIT 1", device_id, self.id ) @@ -675,17 +679,15 @@ impl WireguardNetwork { device_id: i64, ) -> Result, SqlxError> { let connected_at = query_scalar!( - r#" - SELECT - latest_handshake "latest_handshake: NaiveDateTime" - FROM wireguard_peer_stats_view - WHERE device_id = $1 - AND latest_handshake IS NOT NULL - AND (latest_handshake_diff > $2 * interval '1 minute' OR latest_handshake_diff IS NULL) - AND network = $3 - ORDER BY collected_at DESC - LIMIT 1 - "#, + "SELECT \ + latest_handshake \"latest_handshake: NaiveDateTime\" \ + FROM wireguard_peer_stats_view \ + WHERE device_id = $1 \ + AND latest_handshake IS NOT NULL \ + AND (latest_handshake_diff > $2 * interval '1 minute' OR latest_handshake_diff IS NULL) \ + AND network = $3 \ + ORDER BY collected_at DESC \ + LIMIT 1", device_id, WIREGUARD_MAX_HANDSHAKE_MINUTES as f64, self.id @@ -716,19 +718,17 @@ impl WireguardNetwork { .collect::>() .join(","); let query = format!( - r#" - SELECT - device_id, - date_trunc($1, collected_at) as collected_at, - cast(sum(download) as bigint) as download, - cast(sum(upload) as bigint) as upload - FROM wireguard_peer_stats_view - WHERE device_id IN ({device_ids}) - AND collected_at >= $2 - AND network = $3 - GROUP BY 1, 2 - ORDER BY 1, 2 - "# + "SELECT \ + device_id, \ + date_trunc($1, collected_at) as collected_at, \ + cast(sum(download) as bigint) as download, \ + cast(sum(upload) as bigint) as upload \ + FROM wireguard_peer_stats_view \ + WHERE device_id IN ({device_ids}) \ + AND collected_at >= $2 \ + AND network = $3 \ + GROUP BY 1, 2 \ + ORDER BY 1, 2" ); let stats: Vec = query_as(&query) .bind(aggregation.fstring()) @@ -738,14 +738,15 @@ impl WireguardNetwork { .await?; let mut result = Vec::new(); for device in devices { - let latest_stats = self.fetch_latest_stats(conn, device.id.unwrap()).await?; + let Some(device_id) = device.id else { continue }; + let latest_stats = self.fetch_latest_stats(conn, device_id).await?; result.push(WireguardDeviceStatsRow { - id: device.id.unwrap(), + id: device_id, user_id: device.user_id, name: device.name.clone(), wireguard_ip: latest_stats.as_ref().and_then(Self::parse_wireguard_ip), public_ip: latest_stats.as_ref().and_then(Self::parse_public_ip), - connected_at: self.connected_at(conn, device.id.unwrap()).await?, + connected_at: self.connected_at(conn, device_id).await?, // Filter stats for this device stats: stats .iter() @@ -770,18 +771,16 @@ impl WireguardNetwork { // Retrieve connected devices from database let devices = query_as!( Device, - r#" - WITH s AS ( - SELECT DISTINCT ON (device_id) * - FROM wireguard_peer_stats - ORDER BY device_id, latest_handshake DESC - ) - SELECT - d.id "id?", d.name, d.wireguard_pubkey, d.user_id, d.created - FROM device d - JOIN s ON d.id = s.device_id - WHERE s.latest_handshake >= $1 AND s.network = $2 - "#, + "WITH s AS ( \ + SELECT DISTINCT ON (device_id) * \ + FROM wireguard_peer_stats \ + ORDER BY device_id, latest_handshake DESC \ + ) \ + SELECT \ + d.id \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created \ + FROM device d \ + JOIN s ON d.id = s.device_id \ + WHERE s.latest_handshake >= $1 AND s.network = $2", oldest_handshake, self.id, ) @@ -814,15 +813,13 @@ impl WireguardNetwork { ) -> Result { let activity_stats = query_as!( WireguardNetworkActivityStats, - r#" - SELECT - COALESCE(COUNT(DISTINCT(u.id)), 0) as "active_users!", - COALESCE(COUNT(DISTINCT(s.device_id)), 0) as "active_devices!" - FROM "user" u - JOIN device d ON d.user_id = u.id - JOIN wireguard_peer_stats s ON s.device_id = d.id - WHERE latest_handshake >= $1 AND s.network = $2 - "#, + "SELECT \ + COALESCE(COUNT(DISTINCT(u.id)), 0) as \"active_users!\", \ + COALESCE(COUNT(DISTINCT(s.device_id)), 0) as \"active_devices!\" \ + FROM \"user\" u \ + JOIN device d ON d.user_id = u.id \ + JOIN wireguard_peer_stats s ON s.device_id = d.id \ + WHERE latest_handshake >= $1 AND s.network = $2", from, self.id, ) @@ -840,15 +837,13 @@ impl WireguardNetwork { (Utc::now() - Duration::minutes(WIREGUARD_MAX_HANDSHAKE_MINUTES.into())).naive_utc(); let activity_stats = query_as!( WireguardNetworkActivityStats, - r#" - SELECT - COALESCE(COUNT(DISTINCT(u.id)), 0) as "active_users!", - COALESCE(COUNT(DISTINCT(s.device_id)), 0) as "active_devices!" - FROM "user" u - JOIN device d ON d.user_id = u.id - JOIN wireguard_peer_stats s ON s.device_id = d.id - WHERE latest_handshake >= $1 AND s.network = $2 - "#, + "SELECT \ + COALESCE(COUNT(DISTINCT(u.id)), 0) as \"active_users!\", \ + COALESCE(COUNT(DISTINCT(s.device_id)), 0) as \"active_devices!\" \ + FROM \"user\" u \ + JOIN device d ON d.user_id = u.id \ + JOIN wireguard_peer_stats s ON s.device_id = d.id \ + WHERE latest_handshake >= $1 AND s.network = $2", from, self.id ) @@ -867,16 +862,14 @@ impl WireguardNetwork { ) -> Result, SqlxError> { let stats = query_as!( WireguardStatsRow, - r#" - SELECT - date_trunc($1, collected_at) "collected_at: NaiveDateTime", - cast(sum(upload) AS bigint) upload, cast(sum(download) AS bigint) download - FROM wireguard_peer_stats_view - WHERE collected_at >= $2 AND network = $3 - GROUP BY 1 - ORDER BY 1 - LIMIT $4 - "#, + "SELECT \ + date_trunc($1, collected_at) \"collected_at: NaiveDateTime\", \ + cast(sum(upload) AS bigint) upload, cast(sum(download) AS bigint) download \ + FROM wireguard_peer_stats_view \ + WHERE collected_at >= $2 AND network = $3 \ + GROUP BY 1 \ + ORDER BY 1 \ + LIMIT $4", aggregation.fstring(), from, self.id, @@ -923,6 +916,9 @@ impl Default for WireguardNetwork { dns: Option::default(), allowed_ips: Vec::default(), connected_at: Option::default(), + mfa_enabled: false, + keepalive_interval: DEFAULT_KEEPALIVE_INTERVAL, + peer_disconnect_threshold: DEFAULT_DISCONNECT_THRESHOLD, } } } @@ -1014,11 +1010,11 @@ mod test { async fn add_devices(pool: &DbPool, network: &WireguardNetwork, count: usize) { let mut user = User::new( - "testuser".to_string(), + "testuser", Some("hunter2"), - "Tester".to_string(), - "Test".to_string(), - "test@test.com".to_string(), + "Tester", + "Test", + "test@test.com", None, ); user.save(pool).await.unwrap(); @@ -1095,11 +1091,11 @@ mod test { network.save(&pool).await.unwrap(); let mut user = User::new( - "testuser".to_string(), + "testuser", Some("hunter2"), - "Tester".to_string(), - "Test".to_string(), - "test@test.com".to_string(), + "Tester", + "Test", + "test@test.com", None, ); user.save(&pool).await.unwrap(); @@ -1145,11 +1141,11 @@ mod test { network.save(&pool).await.unwrap(); let mut user = User::new( - "testuser".to_string(), + "testuser", Some("hunter2"), - "Tester".to_string(), - "Test".to_string(), - "test@test.com".to_string(), + "Tester", + "Test", + "test@test.com", None, ); user.save(&pool).await.unwrap(); diff --git a/src/error.rs b/src/error.rs index cce08e63e..3c003b0f9 100644 --- a/src/error.rs +++ b/src/error.rs @@ -5,11 +5,11 @@ use thiserror::Error; use crate::{ auth::failed_login::FailedLoginError, db::models::{ - device::DeviceError, enrollment::EnrollmentError, error::ModelError, + device::DeviceError, enrollment::TokenError, error::ModelError, wireguard::WireguardNetworkError, }, grpc::GatewayMapError, - ldap::error::OriLDAPError, + ldap::error::LdapError, templates::TemplateError, }; @@ -64,12 +64,12 @@ impl From for WebError { } } -impl From for WebError { - fn from(error: OriLDAPError) -> Self { +impl From for WebError { + fn from(error: LdapError) -> Self { match error { - OriLDAPError::ObjectNotFound(msg) => Self::ObjectNotFound(msg), - OriLDAPError::Ldap(msg) => Self::Ldap(msg), - OriLDAPError::MissingSettings => Self::Ldap("LDAP settings are missing".to_string()), + LdapError::ObjectNotFound(msg) => Self::ObjectNotFound(msg), + LdapError::Ldap(msg) => Self::Ldap(msg), + LdapError::MissingSettings => Self::Ldap("LDAP settings are missing".to_string()), } } } @@ -126,23 +126,23 @@ impl From for WebError { } } -impl From for WebError { - fn from(err: EnrollmentError) -> Self { +impl From for WebError { + fn from(err: TokenError) -> Self { error!("{}", err); match err { - EnrollmentError::DbError(msg) => WebError::DbError(msg.to_string()), - EnrollmentError::NotFound - | EnrollmentError::UserNotFound - | EnrollmentError::AdminNotFound => WebError::ObjectNotFound(err.to_string()), - EnrollmentError::TokenExpired - | EnrollmentError::SessionExpired - | EnrollmentError::TokenUsed => WebError::Authorization(err.to_string()), - EnrollmentError::AlreadyActive => WebError::BadRequest(err.to_string()), - EnrollmentError::NotificationError(_) - | EnrollmentError::WelcomeMsgNotConfigured - | EnrollmentError::WelcomeEmailNotConfigured - | EnrollmentError::TemplateError(_) - | EnrollmentError::TemplateErrorInternal(_) => { + TokenError::DbError(msg) => WebError::DbError(msg.to_string()), + TokenError::NotFound | TokenError::UserNotFound | TokenError::AdminNotFound => { + WebError::ObjectNotFound(err.to_string()) + } + TokenError::TokenExpired | TokenError::SessionExpired | TokenError::TokenUsed => { + WebError::Authorization(err.to_string()) + } + TokenError::AlreadyActive => WebError::BadRequest(err.to_string()), + TokenError::NotificationError(_) + | TokenError::WelcomeMsgNotConfigured + | TokenError::WelcomeEmailNotConfigured + | TokenError::TemplateError(_) + | TokenError::TemplateErrorInternal(_) => { WebError::Http(StatusCode::INTERNAL_SERVER_ERROR) } } diff --git a/src/grpc/auth.rs b/src/grpc/auth.rs index 950eb0ac7..992fce4d3 100644 --- a/src/grpc/auth.rs +++ b/src/grpc/auth.rs @@ -1,3 +1,8 @@ +use std::sync::{Arc, Mutex}; + +use jsonwebtoken::errors::Error as JWTError; +use tonic::{Request, Response, Status}; + use crate::{ auth::{ failed_login::{check_username, log_failed_login_attempt, FailedLoginMap}, @@ -5,9 +10,6 @@ use crate::{ }, db::{DbPool, User}, }; -use jsonwebtoken::errors::Error as JWTError; -use std::sync::{Arc, Mutex}; -use tonic::{Request, Response, Status}; tonic::include_proto!("auth"); @@ -40,14 +42,14 @@ impl auth_service_server::AuthService for AuthServer { request: Request, ) -> Result, Status> { let request = request.into_inner(); - debug!("Authenticating user {}", &request.username); + debug!("Authenticating user {}", request.username); // check if user can proceed with login check_username(&self.failed_logins, &request.username) .map_err(|_| Status::resource_exhausted("too many login requests"))?; if let Ok(Some(user)) = User::find_by_username(&self.pool, &request.username).await { if user.verify_password(&request.password).is_ok() { - info!("Authentication successful for user {}", &request.username); + info!("Authentication successful for user {}", request.username); Ok(Response::new(AuthenticateResponse { token: Self::create_jwt(&request.username).map_err(|_| { log_failed_login_attempt(&self.failed_logins, &request.username); @@ -55,12 +57,12 @@ impl auth_service_server::AuthService for AuthServer { })?, })) } else { - warn!("Invalid login credentials for user {}", &request.username); + warn!("Invalid login credentials for user {}", request.username); log_failed_login_attempt(&self.failed_logins, &request.username); Err(Status::unauthenticated("invalid credentials")) } } else { - warn!("User {} not found", &request.username); + warn!("User {} not found", request.username); log_failed_login_attempt(&self.failed_logins, &request.username); Err(Status::unauthenticated("invalid credentials")) } diff --git a/src/grpc/desktop_client_mfa.rs b/src/grpc/desktop_client_mfa.rs new file mode 100644 index 000000000..c360d9435 --- /dev/null +++ b/src/grpc/desktop_client_mfa.rs @@ -0,0 +1,275 @@ +use super::proto::{ + ClientMfaFinishRequest, ClientMfaFinishResponse, ClientMfaStartRequest, ClientMfaStartResponse, + MfaMethod, +}; +use crate::{ + auth::{Claims, ClaimsType}, + db::{ + models::device::{DeviceInfo, DeviceNetworkInfo, WireguardNetworkDevice}, + DbPool, Device, GatewayEvent, User, UserInfo, WireguardNetwork, + }, + handlers::mail::send_email_mfa_code_email, + mail::Mail, +}; +use std::collections::HashMap; +use tokio::sync::{broadcast::Sender, mpsc::UnboundedSender}; +use tonic::Status; + +const SESSION_TIMEOUT: u64 = 60 * 5; // 10 minutes + +struct ClientLoginSession { + method: MfaMethod, + location: WireguardNetwork, + device: Device, + user: User, +} + +pub(super) struct ClientMfaServer { + pool: DbPool, + mail_tx: UnboundedSender, + wireguard_tx: Sender, + sessions: HashMap, +} + +impl ClientMfaServer { + #[must_use] + pub fn new( + pool: DbPool, + mail_tx: UnboundedSender, + wireguard_tx: Sender, + ) -> Self { + Self { + pool, + mail_tx, + wireguard_tx, + sessions: HashMap::new(), + } + } + fn generate_token(&self, pubkey: &str) -> Result { + Claims::new( + ClaimsType::DesktopClient, + String::new(), + pubkey.into(), + SESSION_TIMEOUT, + ) + .to_jwt() + .map_err(|err| { + error!("Failed to generate JWT token: {err:?}"); + Status::internal("unexpected error") + }) + } + + /// Validate JWT and extract client pubkey + fn parse_token(&self, token: &str) -> Result { + let claims = Claims::from_jwt(ClaimsType::DesktopClient, token).map_err(|err| { + error!("Failed to parse JWT token: {err:?}"); + Status::invalid_argument("invalid token") + })?; + Ok(claims.client_id) + } + + pub async fn start_client_mfa_login( + &mut self, + request: ClientMfaStartRequest, + ) -> Result { + info!("Starting desktop client login: {request:?}"); + // fetch location + let Ok(Some(location)) = + WireguardNetwork::find_by_id(&self.pool, request.location_id).await + else { + error!("Failed to find location with ID {}", request.location_id); + return Err(Status::invalid_argument("location not found")); + }; + + // fetch device + let Ok(Some(device)) = Device::find_by_pubkey(&self.pool, &request.pubkey).await else { + error!("Failed to find device with pubkey {}", request.pubkey); + return Err(Status::invalid_argument("device not found")); + }; + + // fetch user + let Ok(Some(user)) = User::find_by_id(&self.pool, device.user_id).await else { + error!("Failed to find user with ID {}", device.user_id); + return Err(Status::invalid_argument("user not found")); + }; + let user_info = UserInfo::from_user(&self.pool, &user).await.map_err(|_| { + error!("Failed to fetch user info for {}", user.username); + Status::internal("unexpected error") + })?; + + // validate user is allowed to connect to a given location + let mut transaction = self.pool.begin().await.map_err(|_| { + error!("Failed to begin transaction"); + Status::internal("unexpected error") + })?; + let allowed_groups = location + .get_allowed_groups(&mut transaction) + .await + .map_err(|err| { + error!("Failed to fetch allowed groups for location {location}: {err:?}"); + Status::internal("unexpected error") + })?; + if let Some(groups) = allowed_groups { + // check if user belongs to one of allowed groups + if !groups + .iter() + .any(|allowed_group| user_info.groups.contains(allowed_group)) + { + error!( + "User {} not allowed to connect to location {location}", + user.username + ); + return Err(Status::unauthenticated("unauthorized")); + } + } + + // check if selected method is enabled + let method = MfaMethod::try_from(request.method).map_err(|err| { + error!("Invalid MFA method selected: {err}"); + Status::invalid_argument("invalid MFA method selected") + })?; + match method { + MfaMethod::Totp => { + if !user.totp_enabled { + error!("TOTP not enabled for user {}", user.username); + return Err(Status::invalid_argument( + "selected MFA method not available", + )); + } + } + MfaMethod::Email => { + if !user.email_mfa_enabled { + error!("Email MFA not enabled for user {}", user.username); + return Err(Status::invalid_argument( + "selected MFA method not available", + )); + } + // send email code + send_email_mfa_code_email(&user, &self.mail_tx, None).map_err(|err| { + error!( + "Failed to send email MFA code for user {}: {err:?}", + user.username + ); + Status::internal("unexpected error") + })?; + } + }; + + // generate auth token + let token = self.generate_token(&request.pubkey)?; + + // store login session + self.sessions.insert( + request.pubkey, + ClientLoginSession { + method, + location, + device, + user, + }, + ); + + Ok(ClientMfaStartResponse { token }) + } + + pub async fn finish_client_mfa_login( + &mut self, + request: ClientMfaFinishRequest, + ) -> Result { + info!("Finishing desktop client login: {request:?}"); + // get pubkey from token + let pubkey = self.parse_token(&request.token)?; + + // fetch login session + let Some(session) = self.sessions.get(&pubkey) else { + error!("Client login session not found"); + return Err(Status::invalid_argument("login session not found")); + }; + let ClientLoginSession { + method, + device, + location, + user, + } = session; + + // validate code + match method { + MfaMethod::Totp => { + if !user.verify_totp_code(request.code) { + error!("Provided TOTP code is not valid"); + return Err(Status::unauthenticated("unauthorized")); + } + } + MfaMethod::Email => { + if !user.verify_email_mfa_code(request.code) { + error!("Provided email code is not valid"); + return Err(Status::unauthenticated("unauthorized")); + } + } + }; + + // begin transaction + let mut transaction = self.pool.begin().await.map_err(|_| { + error!("Failed to begin transaction"); + Status::internal("unexpected error") + })?; + + // fetch device config for the location + let Ok(Some(mut network_device)) = WireguardNetworkDevice::find( + &mut *transaction, + device.id.expect("Missing device ID"), + location.id.expect("Missing location ID"), + ) + .await + else { + error!("Failed to fetch network config for device {device} and location {location}"); + return Err(Status::internal("unexpected error")); + }; + + // generate PSK + let key = WireguardNetwork::genkey(); + network_device.preshared_key = Some(key.public.clone()); + + // authorize device for given location + network_device.is_authorized = true; + + // save updated network config + network_device + .update(&mut *transaction) + .await + .map_err(|err| { + error!("Failed to update device network config {network_device:?}: {err:?}"); + Status::internal("unexpected error") + })?; + + // send gateway event + debug!("Sending `peer_create` message to gateway"); + let device_info = DeviceInfo { + device: device.clone(), + network_info: vec![DeviceNetworkInfo { + network_id: location.id.expect("Missing location ID"), + device_wireguard_ip: network_device.wireguard_ip, + preshared_key: network_device.preshared_key, + is_authorized: network_device.is_authorized, + }], + }; + let event = GatewayEvent::DeviceCreated(device_info); + self.wireguard_tx.send(event).map_err(|err| { + error!("Error sending WireGuard event: {err}"); + Status::internal("unexpected error") + })?; + + // remove login session from map + self.sessions.remove(&pubkey); + + // commit transaction + transaction.commit().await.map_err(|_| { + error!("Failed to commit transaction"); + Status::internal("unexpected error") + })?; + + Ok(ClientMfaFinishResponse { + preshared_key: key.public, + }) + } +} diff --git a/src/grpc/enrollment.rs b/src/grpc/enrollment.rs index 5e32e2ede..c5ceee113 100644 --- a/src/grpc/enrollment.rs +++ b/src/grpc/enrollment.rs @@ -1,11 +1,10 @@ use std::sync::Arc; use crate::{ - config::DefGuardConfig, db::{ models::{ device::{DeviceConfig, DeviceInfo, WireguardNetworkDevice}, - enrollment::{Enrollment, EnrollmentError}, + enrollment::{Token, TokenError, ENROLLMENT_TOKEN_TYPE}, wireguard::WireguardNetwork, }, DbPool, Device, GatewayEvent, Settings, User, @@ -15,55 +14,58 @@ use crate::{ ldap::utils::ldap_add_user, mail::Mail, templates::{self, TemplateLocation}, + SERVER_CONFIG, }; use ipnetwork::IpNetwork; use reqwest::Url; use sqlx::Transaction; use tokio::sync::{broadcast::Sender, mpsc::UnboundedSender}; -use tonic::{Request, Response, Status}; +use tonic::Status; +use uaparser::UserAgentParser; -#[allow(non_snake_case)] -pub mod proto { - tonic::include_proto!("enrollment"); -} -use proto::{ - enrollment_service_server, ActivateUserRequest, AdminInfo, Device as ProtoDevice, - DeviceConfig as ProtoDeviceConfig, DeviceConfigResponse, EnrollmentStartRequest, - EnrollmentStartResponse, ExistingDevice, InitialUserInfo, NewDevice, +use super::proto::{ + ActivateUserRequest, AdminInfo, Device as ProtoDevice, DeviceConfig as ProtoDeviceConfig, + DeviceConfigResponse, EnrollmentStartRequest, EnrollmentStartResponse, ExistingDevice, + InitialUserInfo, NewDevice, }; -use uaparser::UserAgentParser; -pub struct EnrollmentServer { +pub(super) struct EnrollmentServer { pool: DbPool, wireguard_tx: Sender, mail_tx: UnboundedSender, user_agent_parser: Arc, - config: DefGuardConfig, ldap_feature_active: bool, } -struct Instance { +struct InstanceInfo { id: uuid::Uuid, name: String, url: Url, + proxy_url: Url, + username: String, } -impl Instance { - pub fn new(settings: Settings, url: Url) -> Self { - Instance { +impl InstanceInfo { + pub fn new>(settings: Settings, username: S) -> Self { + let config = SERVER_CONFIG.get().expect("defguard config not found"); + InstanceInfo { id: settings.uuid, name: settings.instance_name, - url, + url: config.url.clone(), + proxy_url: config.enrollment_url.clone(), + username: username.into(), } } } -impl From for proto::InstanceInfo { - fn from(instance: Instance) -> Self { +impl From for super::proto::InstanceInfo { + fn from(instance: InstanceInfo) -> Self { Self { name: instance.name, id: instance.id.to_string(), url: instance.url.to_string(), + proxy_url: instance.proxy_url.to_string(), + username: instance.username, } } } @@ -75,7 +77,6 @@ impl EnrollmentServer { wireguard_tx: Sender, mail_tx: UnboundedSender, user_agent_parser: Arc, - config: DefGuardConfig, ) -> Self { // FIXME: check if LDAP feature is enabled let ldap_feature_active = true; @@ -84,29 +85,22 @@ impl EnrollmentServer { wireguard_tx, mail_tx, user_agent_parser, - config, ldap_feature_active, } } // check if token provided with request corresponds to a valid enrollment session - async fn validate_session( - &self, - request: &Request, - ) -> Result { - debug!("Validating enrollment session token: {request:?}"); - let token = if let Some(token) = request.metadata().get("authorization") { - token - .to_str() - .map_err(|_| Status::unauthenticated("Invalid token"))? - } else { + async fn validate_session(&self, token: Option<&str>) -> Result { + let Some(token) = token else { error!("Missing authorization header in request"); return Err(Status::unauthenticated("Missing authorization header")); }; + debug!("Validating enrollment session token: {token}"); - let enrollment = Enrollment::find_by_id(&self.pool, token).await?; + let enrollment = Token::find_by_id(&self.pool, token).await?; + let config = SERVER_CONFIG.get().expect("defguard config not found"); - if enrollment.is_session_valid(self.config.enrollment_session_timeout.as_secs()) { + if enrollment.is_session_valid(config.enrollment_session_timeout.as_secs()) { Ok(enrollment) } else { error!("Enrollment session expired"); @@ -117,96 +111,102 @@ impl EnrollmentServer { /// Sends given `GatewayEvent` to be handled by gateway GRPC server pub fn send_wireguard_event(&self, event: GatewayEvent) { if let Err(err) = self.wireguard_tx.send(event) { - error!("Error sending wireguard event {err}"); + error!("Error sending WireGuard event {err}"); } } -} -#[tonic::async_trait] -impl enrollment_service_server::EnrollmentService for EnrollmentServer { - async fn start_enrollment( + pub async fn start_enrollment( &self, - request: Request, - ) -> Result, Status> { - debug!("Starting enrollment session: {request:?}"); - let request = request.into_inner(); + request: EnrollmentStartRequest, + ) -> Result { + let config = SERVER_CONFIG.get().expect("defguard config not found"); // fetch enrollment token - let mut enrollment = Enrollment::find_by_id(&self.pool, &request.token).await?; - - // fetch related users - let user = enrollment.fetch_user(&self.pool).await?; - let admin = enrollment.fetch_admin(&self.pool).await?; + let mut enrollment = Token::find_by_id(&self.pool, &request.token).await?; - let mut transaction = self.pool.begin().await.map_err(|_| { - error!("Failed to begin transaction"); - Status::internal("unexpected error") - })?; + if let Some(token_type) = &enrollment.token_type { + if token_type != ENROLLMENT_TOKEN_TYPE { + return Err(Status::permission_denied("invalid token")); + } - // validate token & start session - info!("Starting enrollment session for user {}", user.username); - let session_deadline = enrollment - .start_session( - &mut transaction, - self.config.enrollment_session_timeout.as_secs(), - ) - .await?; + // fetch related users + let user = enrollment.fetch_user(&self.pool).await?; + let admin = enrollment.fetch_admin(&self.pool).await?; - let settings = Settings::get_settings(&mut *transaction) - .await - .map_err(|_| { - error!("Failed to get settings"); + let mut transaction = self.pool.begin().await.map_err(|_| { + error!("Failed to begin transaction"); Status::internal("unexpected error") })?; - let user_info = InitialUserInfo::from_user(&self.pool, user) - .await - .map_err(|_| { - error!("Failed to get user info"); - Status::internal("unexpected error") - })?; + // validate token & start session + info!("Starting enrollment session for user {}", user.username); + let session_deadline = enrollment + .start_session( + &mut transaction, + config.enrollment_session_timeout.as_secs(), + ) + .await?; - let response = EnrollmentStartResponse { - admin: Some(admin.into()), - user: Some(user_info), - deadline_timestamp: session_deadline.timestamp(), - final_page_content: enrollment - .get_welcome_page_content(&mut transaction) - .await?, - vpn_setup_optional: settings.enrollment_vpn_step_optional, - instance: Some(Instance::new(settings, self.config.url.clone()).into()), - }; + let settings = Settings::get_settings(&mut *transaction) + .await + .map_err(|_| { + error!("Failed to get settings"); + Status::internal("unexpected error") + })?; - transaction.commit().await.map_err(|_| { - error!("Failed to commit transaction"); - Status::internal("unexpected error") - })?; + let vpn_setup_optional = settings.enrollment_vpn_step_optional; + let instance_info = InstanceInfo::new(settings, &user.username); - Ok(Response::new(response)) - } + let user_info = InitialUserInfo::from_user(&self.pool, user) + .await + .map_err(|_| { + error!("Failed to get user info"); + Status::internal("unexpected error") + })?; - async fn activate_user( - &self, - request: Request, - ) -> Result, Status> { - debug!("Activating user account: {request:?}"); - let enrollment = self.validate_session(&request).await?; + let admin_info = admin.map(AdminInfo::from); + + let response = super::proto::EnrollmentStartResponse { + admin: admin_info, + user: Some(user_info), + deadline_timestamp: session_deadline.timestamp(), + final_page_content: enrollment + .get_welcome_page_content(&mut transaction) + .await?, + vpn_setup_optional, + instance: Some(instance_info.into()), + }; - let ip_address = request - .metadata() - .get("ip_address") - .and_then(|value| value.to_str().map(ToString::to_string).ok()) - .unwrap_or_default(); + transaction.commit().await.map_err(|_| { + error!("Failed to commit transaction"); + Status::internal("unexpected error") + })?; - let user_agent = request - .metadata() - .get("user_agent") - .and_then(|value| value.to_str().map(ToString::to_string).ok()) - .unwrap_or_default(); + Ok(response) + } else { + Err(Status::permission_denied("invalid token")) + } + } - let device_info = get_device_info(&self.user_agent_parser, &user_agent); + pub async fn activate_user( + &self, + request: ActivateUserRequest, + req_device_info: Option, + ) -> Result<(), Status> { + debug!("Activating user account: {request:?}"); + let enrollment = self.validate_session(request.token.as_deref()).await?; + + let ip_address; + let device_info; + if let Some(info) = req_device_info { + ip_address = info.ip_address.unwrap_or_default(); + let user_agent = info.user_agent.unwrap_or_default(); + device_info = get_device_info(&self.user_agent_parser, &user_agent); + } else { + ip_address = String::new(); + device_info = None; + } // check if password is strong enough - let request = request.into_inner(); if let Err(err) = check_password_strength(&request.password) { error!("Password not strong enough: {err}"); return Err(Status::invalid_argument("password not strong enough")); @@ -252,29 +252,39 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { &self.mail_tx, &user, &settings, - ip_address.clone(), - device_info.clone(), + &ip_address, + device_info.as_deref(), ) .await?; // send success notification to admin let admin = enrollment.fetch_admin(&mut *transaction).await?; - Enrollment::send_admin_notification(&self.mail_tx, &admin, &user, ip_address, device_info)?; + + if let Some(admin) = admin { + Token::send_admin_notification( + &self.mail_tx, + &admin, + &user, + &ip_address, + device_info.as_deref(), + )?; + } transaction.commit().await.map_err(|_| { error!("Failed to commit transaction"); Status::internal("unexpected error") })?; - Ok(Response::new(())) + Ok(()) } - async fn create_device( + pub async fn create_device( &self, - request: Request, - ) -> Result, Status> { + request: NewDevice, + req_device_info: Option, + ) -> Result { debug!("Adding new user device: {request:?}"); - let enrollment = self.validate_session(&request).await?; + let enrollment = self.validate_session(request.token.as_deref()).await?; // fetch related users let user = enrollment.fetch_user(&self.pool).await?; @@ -282,21 +292,17 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { // add device info!("Adding new device for user {}", user.username); - let ip_address = request - .metadata() - .get("ip_address") - .and_then(|value| value.to_str().map(ToString::to_string).ok()) - .unwrap_or_default(); - - let user_agent = request - .metadata() - .get("user_agent") - .and_then(|value| value.to_str().map(ToString::to_string).ok()) - .unwrap_or_default(); - - let device_info = get_device_info(&self.user_agent_parser, &user_agent); + let ip_address; + let device_info; + if let Some(info) = req_device_info { + ip_address = info.ip_address.unwrap_or_default(); + let user_agent = info.user_agent.unwrap_or_default(); + device_info = get_device_info(&self.user_agent_parser, &user_agent); + } else { + ip_address = String::new(); + device_info = None; + } - let request = request.into_inner(); Device::validate_pubkey(&request.pubkey).map_err(|_| { error!("Invalid pubkey {}", request.pubkey); Status::invalid_argument("invalid pubkey") @@ -312,16 +318,17 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { Status::internal("unexpected error") })?; - let (network_info, configs) = device - .add_to_all_networks(&mut transaction, &self.config.admin_groupname) - .await - .map_err(|err| { - error!( - "Failed to add device {} to existing networks: {err}", - device.name - ); - Status::internal("unexpected error") - })?; + let (network_info, configs) = + device + .add_to_all_networks(&mut transaction) + .await + .map_err(|err| { + error!( + "Failed to add device {} to existing networks: {err}", + device.name + ); + Status::internal("unexpected error") + })?; self.send_wireguard_event(GatewayEvent::DeviceCreated(DeviceInfo { device: device.clone(), @@ -354,29 +361,30 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { &template_locations, &user.email, &self.mail_tx, - Some(ip_address), - device_info, + Some(&ip_address), + device_info.as_deref(), ) - .await - .map_err(|_| Status::internal("Failed to render new device added tempalte"))?; + .map_err(|_| Status::internal("Failed to render new device added template"))?; let response = DeviceConfigResponse { device: Some(device.into()), configs: configs.into_iter().map(Into::into).collect(), - instance: Some(Instance::new(settings, self.config.url.clone()).into()), + instance: Some(InstanceInfo::new(settings, &user.username).into()), }; - Ok(Response::new(response)) + Ok(response) } /// Get all information needed /// to update instance information for desktop client - async fn get_network_info( + pub async fn get_network_info( &self, - request: Request, - ) -> Result, Status> { - let _enrollment = self.validate_session(&request).await?; + request: ExistingDevice, + ) -> Result { + let enrollment = self.validate_session(request.token.as_deref()).await?; + + // get enrollment user + let user = enrollment.fetch_user(&self.pool).await?; - let request = request.into_inner(); Device::validate_pubkey(&request.pubkey).map_err(|_| { error!("Invalid pubkey {}", request.pubkey); Status::invalid_argument("invalid pubkey") @@ -399,19 +407,19 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { Status::internal(format!("unexpected error: {err}")) })?; - let mut configs: Vec = vec![]; + let mut configs: Vec = Vec::new(); if let Some(device) = device { for network in networks { - let wireguard_network_device = WireguardNetworkDevice::find( - &self.pool, - device.id.unwrap(), - network.id.unwrap(), - ) - .await - .map_err(|err| { - error!("Invalid failed to get networks {err}"); - Status::internal(format!("unexpected error: {err}")) - })?; + let (Some(device_id), Some(network_id)) = (device.id, network.id) else { + continue; + }; + let wireguard_network_device = + WireguardNetworkDevice::find(&self.pool, device_id, network_id) + .await + .map_err(|err| { + error!("Invalid failed to get networks {err}"); + Status::internal(format!("unexpected error: {err}")) + })?; if let Some(wireguard_network_device) = wireguard_network_device { let allowed_ips = network .allowed_ips @@ -421,13 +429,15 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { .join(","); let config = ProtoDeviceConfig { config: device.create_config(&network, &wireguard_network_device), - network_id: network.id.unwrap(), + network_id, network_name: network.name, assigned_ip: wireguard_network_device.wireguard_ip.to_string(), - endpoint: network.endpoint, + endpoint: format!("{}:{}", network.endpoint, network.port), pubkey: network.pubkey, allowed_ips, dns: network.dns, + mfa_enabled: network.mfa_enabled, + keepalive_interval: network.keepalive_interval, }; configs.push(config); } @@ -436,10 +446,10 @@ impl enrollment_service_server::EnrollmentService for EnrollmentServer { let response = DeviceConfigResponse { device: Some(device.into()), configs, - instance: Some(Instance::new(settings, self.config.url.clone()).into()), + instance: Some(InstanceInfo::new(settings, &user.username).into()), }; - Ok(Response::new(response)) + Ok(response) } else { Err(Status::internal("device not found error")) } @@ -490,6 +500,8 @@ impl From for ProtoDeviceConfig { pubkey: config.pubkey, allowed_ips, dns: config.dns, + mfa_enabled: config.mfa_enabled, + keepalive_interval: config.keepalive_interval, } } } @@ -506,7 +518,7 @@ impl From for ProtoDevice { } } -impl Enrollment { +impl Token { // Send configured welcome email to user after finishing enrollment async fn send_welcome_email( &self, @@ -514,9 +526,9 @@ impl Enrollment { mail_tx: &UnboundedSender, user: &User, settings: &Settings, - ip_address: String, - device_info: Option, - ) -> Result<(), EnrollmentError> { + ip_address: &str, + device_info: Option<&str>, + ) -> Result<(), TokenError> { debug!("Sending welcome mail to {}", user.username); let mail = Mail { to: user.email.clone(), @@ -534,7 +546,7 @@ impl Enrollment { } Err(err) => { error!("Error sending welcome mail: {err}"); - Err(EnrollmentError::NotificationError(err.to_string())) + Err(TokenError::NotificationError(err.to_string())) } } } @@ -544,9 +556,9 @@ impl Enrollment { mail_tx: &UnboundedSender, admin: &User, user: &User, - ip_address: String, - device_info: Option, - ) -> Result<(), EnrollmentError> { + ip_address: &str, + device_info: Option<&str>, + ) -> Result<(), TokenError> { debug!( "Sending enrollment success notification for user {} to {}", user.username, admin.username @@ -573,7 +585,7 @@ impl Enrollment { } Err(err) => { error!("Error sending welcome mail: {err}"); - Err(EnrollmentError::NotificationError(err.to_string())) + Err(TokenError::NotificationError(err.to_string())) } } } diff --git a/src/grpc/gateway.rs b/src/grpc/gateway.rs index 9927161a8..a347290ac 100644 --- a/src/grpc/gateway.rs +++ b/src/grpc/gateway.rs @@ -1,18 +1,11 @@ -use super::GatewayMap; -use crate::{ - db::{ - models::wireguard::{WireguardNetwork, WireguardPeerStats}, - DbPool, Device, GatewayEvent, - }, - mail::Mail, -}; -use chrono::{NaiveDateTime, Utc}; -use sqlx::{query_as, Error as SqlxError}; use std::{ pin::Pin, sync::{Arc, Mutex}, task::{Context, Poll}, }; + +use chrono::{NaiveDateTime, Utc}; +use sqlx::{query, Error as SqlxError, PgExecutor}; use tokio::{ sync::{ broadcast::{Receiver as BroadcastReceiver, Sender}, @@ -23,6 +16,15 @@ use tokio::{ use tokio_stream::Stream; use tonic::{metadata::MetadataMap, Code, Request, Response, Status}; +use super::GatewayMap; +use crate::{ + db::{ + models::wireguard::{WireguardNetwork, WireguardPeerStats}, + DbPool, Device, GatewayEvent, + }, + mail::Mail, +}; + tonic::include_proto!("gateway"); pub struct GatewayServer { @@ -33,26 +35,40 @@ pub struct GatewayServer { } impl WireguardNetwork { - /// Get a list of all peers + /// Get a list of all allowed peers + /// + /// Each device is marked as allowed or not allowed in a given network, + /// which enables enforcing peer disconnect in MFA-protected networks. pub async fn get_peers<'e, E>(&self, executor: E) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { debug!("Fetching all peers for network {}", self.id.unwrap()); - let result = query_as!( - Peer, - r#" - SELECT d.wireguard_pubkey as pubkey, array[host(wnd.wireguard_ip)] as "allowed_ips!: Vec" FROM wireguard_network_device wnd - JOIN device d - ON wnd.device_id = d.id - WHERE wireguard_network_id = $1 - ORDER BY d.id ASC - "#, - self.id + let rows = query!( + "SELECT d.wireguard_pubkey as pubkey, preshared_key, \ + array[host(wnd.wireguard_ip)] as \"allowed_ips!: Vec\" \ + FROM wireguard_network_device wnd \ + JOIN device d ON wnd.device_id = d.id \ + WHERE wireguard_network_id = $1 AND (is_authorized = true OR NOT $2) \ + ORDER BY d.id ASC", + self.id, + self.mfa_enabled ) .fetch_all(executor) .await?; + // keepalive has to be added manually because Postgres + // doesn't support unsigned integers + let result = rows + .into_iter() + .map(|row| Peer { + pubkey: row.pubkey, + allowed_ips: row.allowed_ips, + preshared_key: row.preshared_key, + keepalive_interval: Some(self.keepalive_interval as u32), + }) + .collect(); + Ok(result) } } @@ -183,7 +199,7 @@ impl GatewayUpdatesHandler { self.gateway_hostname, self.network ); while let Ok(update) = self.events_rx.recv().await { - debug!("Received wireguard update: {:?}", update); + debug!("Received wireguard update: {update:?}"); let result = match update { GatewayEvent::NetworkCreated(network_id, network) => { if network_id == self.network_id { @@ -194,7 +210,10 @@ impl GatewayUpdatesHandler { } GatewayEvent::NetworkModified(network_id, network, peers) => { if network_id == self.network_id { - self.send_network_update(&network, peers, 1).await + let result = self.send_network_update(&network, peers, 1).await; + // update stored network data + self.network = network; + result } else { Ok(()) } @@ -214,10 +233,18 @@ impl GatewayUpdatesHandler { .find(|info| info.network_id == self.network_id) { Some(network_info) => { + if self.network.mfa_enabled && !network_info.is_authorized { + debug!("Created WireGuard device is not authorized to connect to MFA enabled location"); + continue; + }; self.send_peer_update( Peer { pubkey: device.device.wireguard_pubkey, allowed_ips: vec![network_info.device_wireguard_ip.to_string()], + preshared_key: network_info.preshared_key.clone(), + keepalive_interval: Some( + self.network.keepalive_interval as u32, + ), }, 0, ) @@ -238,6 +265,10 @@ impl GatewayUpdatesHandler { Peer { pubkey: device.device.wireguard_pubkey, allowed_ips: vec![network_info.device_wireguard_ip.to_string()], + preshared_key: network_info.preshared_key.clone(), + keepalive_interval: Some( + self.network.keepalive_interval as u32, + ), }, 1, ) @@ -275,7 +306,7 @@ impl GatewayUpdatesHandler { peers: Vec, update_type: i32, ) -> Result<(), Status> { - debug!("Sending network update for network {}", network); + debug!("Sending network update for network {network}"); if let Err(err) = self .tx .send(Ok(Update { @@ -293,8 +324,8 @@ impl GatewayUpdatesHandler { let msg = format!( "Failed to send network update, network {network}, update type: {update_type}, error: {err}", ); - error!("{msg}"); - return Err(Status::new(tonic::Code::Internal, msg)); + error!(msg); + return Err(Status::new(Code::Internal, msg)); } Ok(()) } @@ -320,11 +351,11 @@ impl GatewayUpdatesHandler { .await { let msg = format!( - "Failed to send network update, network {}, update type: {}, error: {}", - self.network, 2, err, + "Failed to send network update, network {}, update type: 2, error: {err}", + self.network, ); - error!("{}", msg); - return Err(Status::new(tonic::Code::Internal, msg)); + error!(msg); + return Err(Status::new(Code::Internal, msg)); } Ok(()) } @@ -341,11 +372,11 @@ impl GatewayUpdatesHandler { .await { let msg = format!( - "Failed to send peer update for network {}, update type: {}, error: {}", - self.network, update_type, err, + "Failed to send peer update for network {}, update type: {update_type}, error: {err}", + self.network ); - error!("{}", msg); - return Err(Status::new(tonic::Code::Internal, msg)); + error!(msg); + return Err(Status::new(Code::Internal, msg)); } Ok(()) } @@ -360,16 +391,18 @@ impl GatewayUpdatesHandler { update: Some(update::Update::Peer(Peer { pubkey: peer_pubkey.into(), allowed_ips: Vec::new(), + preshared_key: None, + keepalive_interval: None, })), })) .await { let msg = format!( - "Failed to send peer update for network {}, peer {}, update type: 2, error: {}", - self.network, peer_pubkey, err, + "Failed to send peer update for network {}, peer {peer_pubkey}, update type: 2, error: {err}", + self.network, ); - error!("{}", msg); - return Err(Status::new(tonic::Code::Internal, msg)); + error!(msg); + return Err(Status::new(Code::Internal, msg)); } Ok(()) } @@ -381,6 +414,7 @@ pub struct GatewayUpdatesStream { network_id: i64, gateway_hostname: String, gateway_state: Arc>, + pool: DbPool, } impl GatewayUpdatesStream { @@ -391,6 +425,7 @@ impl GatewayUpdatesStream { network_id: i64, gateway_hostname: String, gateway_state: Arc>, + pool: DbPool, ) -> Self { Self { task_handle, @@ -398,6 +433,7 @@ impl GatewayUpdatesStream { network_id, gateway_hostname, gateway_state, + pool, } } } @@ -419,7 +455,7 @@ impl Drop for GatewayUpdatesStream { self.gateway_state .lock() .unwrap() - .disconnect_gateway(self.network_id, self.gateway_hostname.clone()) + .disconnect_gateway(self.network_id, self.gateway_hostname.clone(), &self.pool) .expect("Unable to disconnect gateway."); } } @@ -443,25 +479,19 @@ impl gateway_service_server::GatewayService for GatewayServer { stats.device_id = match Device::find_by_pubkey(&self.pool, &public_key).await { Ok(Some(device)) => device .id - .ok_or_else(|| Status::new(tonic::Code::Internal, "Device has no id"))?, + .ok_or_else(|| Status::new(Code::Internal, "Device has no ID"))?, Ok(None) => { - error!("Device with public key {} not found", &public_key); + error!("Device with public key {public_key} not found"); return Err(Status::new( - tonic::Code::Internal, - format!("Device with public key {} not found", &public_key), + Code::Internal, + format!("Device with public key {public_key} not found"), )); } Err(err) => { - error!( - "Failed to retrieve device with public key {}: {err}", - &public_key - ); + error!("Failed to retrieve device with public key {public_key}: {err}",); return Err(Status::new( - tonic::Code::Internal, - format!( - "Failed to retrieve device with public key {}: {err}", - &public_key - ), + Code::Internal, + format!("Failed to retrieve device with public key {public_key}: {err}",), )); } }; @@ -469,7 +499,7 @@ impl gateway_service_server::GatewayService for GatewayServer { if let Err(err) = stats.save(&self.pool).await { error!("Saving WireGuard peer stats to db failed: {err}"); return Err(Status::new( - tonic::Code::Internal, + Code::Internal, format!("Saving WireGuard peer stats to db failed: {err}"), )); } @@ -486,41 +516,37 @@ impl gateway_service_server::GatewayService for GatewayServer { let network_id = Self::get_network_id(request.metadata())?; let hostname = Self::get_gateway_hostname(request.metadata())?; - let pool = self.pool.clone(); - let mut network = WireguardNetwork::find_by_id(&pool, network_id) + let mut network = WireguardNetwork::find_by_id(&self.pool, network_id) .await .map_err(|e| { - error!("Network {} not found", network_id); - Status::new( - tonic::Code::Internal, - format!("Failed to retrieve network: {e}"), - ) + error!("Network {network_id} not found"); + Status::new(Code::Internal, format!("Failed to retrieve network: {e}")) })? - .ok_or_else(|| Status::new(tonic::Code::Internal, "Network not found"))?; + .ok_or_else(|| Status::new(Code::Internal, "Network not found"))?; info!("Sending configuration to gateway client, network {network}."); + // store connected gateway in memory { let mut state = self.state.lock().unwrap(); state.add_gateway( network_id, - network.name.clone(), + &network.name, hostname, request.into_inner().name, - self.pool.clone(), self.mail_tx.clone(), ); } network.connected_at = Some(Utc::now().naive_utc()); - if let Err(err) = network.save(&pool).await { + if let Err(err) = network.save(&self.pool).await { error!("Failed to update network {network_id} status: {err}"); } - let peers = network.get_peers(&pool).await.map_err(|error| { + let peers = network.get_peers(&self.pool).await.map_err(|error| { error!("Failed to fetch peers for network {network_id}: {error}",); Status::new( - tonic::Code::Internal, + Code::Internal, format!("Failed to retrieve peers for network: {network_id}"), ) })?; @@ -537,7 +563,7 @@ impl gateway_service_server::GatewayService for GatewayServer { .map_err(|_| { error!("Failed to fetch network {gateway_network_id}"); Status::new( - tonic::Code::Internal, + Code::Internal, format!("Failed to retrieve network {gateway_network_id}"), ) })? @@ -554,7 +580,7 @@ impl gateway_service_server::GatewayService for GatewayServer { .connect_gateway(gateway_network_id, &hostname) .map_err(|err| { error!("Failed to connect gateway: {err}"); - Status::new(tonic::Code::Internal, "Failed to connect gateway ") + Status::new(Code::Internal, "Failed to connect gateway") })?; // clone here before moving into a closure @@ -576,6 +602,7 @@ impl gateway_service_server::GatewayService for GatewayServer { gateway_network_id, hostname, Arc::clone(&self.state), + self.pool.clone(), ))) } } diff --git a/src/grpc/mod.rs b/src/grpc/mod.rs index b52a646ee..43a2cf589 100644 --- a/src/grpc/mod.rs +++ b/src/grpc/mod.rs @@ -1,6 +1,6 @@ -use chrono::Duration as ChronoDuration; use std::{ collections::hash_map::HashMap, + fs::read_to_string, time::{Duration, Instant}, }; #[cfg(any(feature = "wireguard", feature = "worker"))] @@ -9,11 +9,19 @@ use std::{ sync::{Arc, Mutex}, }; -use chrono::{NaiveDateTime, Utc}; +use chrono::{Duration as ChronoDuration, NaiveDateTime, Utc}; use serde::Serialize; use thiserror::Error; -use tokio::sync::{broadcast::Sender, mpsc::UnboundedSender}; -use tonic::transport::{Identity, Server, ServerTlsConfig}; +use tokio::{ + sync::{ + broadcast::Sender, + mpsc::{self, UnboundedSender}, + }, + time::sleep, +}; +use tokio_stream::{wrappers::UnboundedReceiverStream, StreamExt}; +use tonic::transport::{Certificate, ClientTlsConfig, Endpoint, Identity, Server, ServerTlsConfig}; +use tonic::Status; use uaparser::UserAgentParser; use uuid::Uuid; @@ -21,7 +29,10 @@ use uuid::Uuid; use self::gateway::{gateway_service_server::GatewayServiceServer, GatewayServer}; use self::{ auth::{auth_service_server::AuthServiceServer, AuthServer}, - enrollment::{proto::enrollment_service_server::EnrollmentServiceServer, EnrollmentServer}, + desktop_client_mfa::ClientMfaServer, + enrollment::EnrollmentServer, + password_reset::PasswordResetServer, + proto::core_response, }; #[cfg(feature = "worker")] use self::{ @@ -39,14 +50,22 @@ use crate::{ }; mod auth; +mod desktop_client_mfa; pub mod enrollment; #[cfg(feature = "wireguard")] pub(crate) mod gateway; #[cfg(any(feature = "wireguard", feature = "worker"))] mod interceptor; +pub mod password_reset; #[cfg(feature = "worker")] pub mod worker; +pub(crate) mod proto { + tonic::include_proto!("defguard.proxy"); +} + +use proto::{core_request, proxy_client::ProxyClient, CoreError, CoreResponse}; + // Helper struct used to handle gateway state // gateways are grouped by network type NetworkId = i64; @@ -80,31 +99,20 @@ impl GatewayMap { pub fn add_gateway( &mut self, network_id: i64, - network_name: String, + network_name: &str, hostname: String, name: Option, - pool: DbPool, mail_tx: UnboundedSender, ) { info!("Adding gateway {hostname} with to gateway map for network {network_id}",); + let gateway_state = GatewayState::new(network_id, network_name, &hostname, name, mail_tx); + if let Some(network_gateway_map) = self.0.get_mut(&network_id) { - network_gateway_map - .entry(hostname.clone()) - .or_insert(GatewayState::new( - network_id, - network_name, - hostname, - name, - pool, - mail_tx, - )); + network_gateway_map.entry(hostname).or_insert(gateway_state); } else { // no map for a given network exists yet let mut network_gateway_map = HashMap::new(); - network_gateway_map.insert( - hostname.clone(), - GatewayState::new(network_id, network_name, hostname, name, pool, mail_tx), - ); + network_gateway_map.insert(hostname, gateway_state); self.0.insert(network_id, network_gateway_map); } } @@ -169,13 +177,14 @@ impl GatewayMap { &mut self, network_id: i64, hostname: String, + pool: &DbPool, ) -> Result<(), GatewayMapError> { info!("Disconnecting gateway {hostname} in network {network_id}"); if let Some(network_gateway_map) = self.0.get_mut(&network_id) { if let Some(state) = network_gateway_map.get_mut(&hostname) { state.connected = false; state.disconnected_at = Some(Utc::now().naive_utc()); - state.send_disconnect_notification()?; + state.send_disconnect_notification(pool)?; return Ok(()); }; }; @@ -203,6 +212,7 @@ impl GatewayMap { None => Vec::new(), } } + // return gateway name #[must_use] pub fn get_network_gateway_name(&self, network_id: i64, hostname: &str) -> Option { @@ -238,42 +248,39 @@ pub struct GatewayState { #[serde(skip)] pub mail_tx: UnboundedSender, #[serde(skip)] - pub pool: DbPool, - #[serde(skip)] pub last_email_notification: Option, } impl GatewayState { #[must_use] - pub fn new( + pub fn new>( network_id: i64, - network_name: String, - hostname: String, + network_name: S, + hostname: S, name: Option, - pool: DbPool, mail_tx: UnboundedSender, ) -> Self { Self { uid: Uuid::new_v4(), connected: false, network_id, - network_name, + network_name: network_name.into(), name, - hostname, + hostname: hostname.into(), connected_at: None, disconnected_at: None, mail_tx, - pool, last_email_notification: None, } } + /// Send gateway disconnected notification /// Sends notification only if last notification time is bigger than specified in config - fn send_disconnect_notification(&mut self) -> Result<(), GatewayMapError> { + fn send_disconnect_notification(&mut self, pool: &DbPool) -> Result<(), GatewayMapError> { // Clone here because self doesn't live long enough let name = self.name.clone(); let mail_tx = self.mail_tx.clone(); - let pool = self.pool.clone(); + let pool = pool.clone(); let hostname = self.hostname.clone(); let network_name = self.network_name.clone(); let send_email = if let Some(last_notification_time) = self.last_email_notification { @@ -294,16 +301,16 @@ impl GatewayState { // To return result instead of logging tokio::spawn(async move { if let Err(e) = - send_gateway_disconnected_email(name, network_name, hostname, &mail_tx, &pool) + send_gateway_disconnected_email(name, network_name, &hostname, &mail_tx, &pool) .await { - error!("Sending gateway disconnected notification failed: {}", e); + error!("Failed to send gateway disconnect notification: {e}"); } }); } else { debug!( - "Gateway {} disconnected not sending email. Last notification time was at {:?}", - hostname, self.last_email_notification + "Gateway {hostname} disconnected. Email notification not sent. Last notification was at {:?}", + self.last_email_notification ); }; @@ -311,6 +318,191 @@ impl GatewayState { } } +const TEN_SECS: Duration = Duration::from_secs(10); + +impl From for CoreError { + fn from(status: Status) -> Self { + Self { + status_code: status.code().into(), + message: status.message().into(), + } + } +} + +/// Bi-directional gRPC stream for comminication with Defguard proxy. +pub async fn run_grpc_bidi_stream( + pool: DbPool, + wireguard_tx: Sender, + mail_tx: UnboundedSender, + user_agent_parser: Arc, +) -> Result<(), anyhow::Error> { + let config = SERVER_CONFIG.get().unwrap(); + + // TODO: merge the two + let enrollment_server = EnrollmentServer::new( + pool.clone(), + wireguard_tx.clone(), + mail_tx.clone(), + user_agent_parser, + ); + let password_reset_server = PasswordResetServer::new(pool.clone(), mail_tx.clone()); + let mut client_mfa_server = ClientMfaServer::new(pool, mail_tx, wireguard_tx); + + let endpoint = Endpoint::from_shared(config.proxy_url.as_deref().unwrap())?; + let endpoint = endpoint.http2_keep_alive_interval(TEN_SECS); + let endpoint = endpoint.tcp_keepalive(Some(TEN_SECS)); + let endpoint = if let Some(ca) = &config.proxy_grpc_ca { + let ca = read_to_string(ca)?; + let tls = ClientTlsConfig::new().ca_certificate(Certificate::from_pem(ca)); + endpoint.tls_config(tls)? + } else { + endpoint + }; + + loop { + info!("Connecting to proxy"); + let mut client = ProxyClient::new(endpoint.connect_lazy()); + let (tx, rx) = mpsc::unbounded_channel(); + let Ok(response) = client.bidi(UnboundedReceiverStream::new(rx)).await else { + info!("Failed to connect to proxy, retrying in 10s"); + sleep(TEN_SECS).await; + continue; + }; + let mut resp_stream = response.into_inner(); + while let Some(received) = resp_stream.next().await { + info!("received message"); + match received { + Ok(received) => { + let payload = match received.payload { + // rpc StartEnrollment (EnrollmentStartRequest) returns (EnrollmentStartResponse) + Some(core_request::Payload::EnrollmentStart(request)) => { + match enrollment_server.start_enrollment(request).await { + Ok(response_payload) => { + Some(core_response::Payload::EnrollmentStart(response_payload)) + } + Err(err) => { + error!("start enrollment error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc ActivateUser (ActivateUserRequest) returns (google.protobuf.Empty) + Some(core_request::Payload::ActivateUser(request)) => { + match enrollment_server + .activate_user(request, received.device_info) + .await + { + Ok(()) => Some(core_response::Payload::Empty(())), + Err(err) => { + error!("activate user error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc CreateDevice (NewDevice) returns (DeviceConfigResponse) + Some(core_request::Payload::NewDevice(request)) => { + match enrollment_server + .create_device(request, received.device_info) + .await + { + Ok(response_payload) => { + Some(core_response::Payload::DeviceConfig(response_payload)) + } + Err(err) => { + error!("create device error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc GetNetworkInfo (ExistingDevice) returns (DeviceConfigResponse) + Some(core_request::Payload::ExistingDevice(request)) => { + match enrollment_server.get_network_info(request).await { + Ok(response_payload) => { + Some(core_response::Payload::DeviceConfig(response_payload)) + } + Err(err) => { + error!("get network info error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc RequestPasswordReset (PasswordResetInitializeRequest) returns (google.protobuf.Empty) + Some(core_request::Payload::PasswordResetInit(request)) => { + match password_reset_server + .request_password_reset(request, received.device_info) + .await + { + Ok(()) => Some(core_response::Payload::Empty(())), + Err(err) => { + error!("password reset init error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc StartPasswordReset (PasswordResetStartRequest) returns (PasswordResetStartResponse) + Some(core_request::Payload::PasswordResetStart(request)) => { + match password_reset_server.start_password_reset(request).await { + Ok(response_payload) => Some( + core_response::Payload::PasswordResetStart(response_payload), + ), + Err(err) => { + error!("password reset start error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc ResetPassword (PasswordResetRequest) returns (google.protobuf.Empty) + Some(core_request::Payload::PasswordReset(request)) => { + match password_reset_server + .reset_password(request, received.device_info) + .await + { + Ok(()) => Some(core_response::Payload::Empty(())), + Err(err) => { + error!("password reset error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc ClientMfaStart (ClientMfaStartRequest) returns (ClientMfaStartResponse) + Some(core_request::Payload::ClientMfaStart(request)) => { + match client_mfa_server.start_client_mfa_login(request).await { + Ok(response_payload) => { + Some(core_response::Payload::ClientMfaStart(response_payload)) + } + Err(err) => { + error!("client MFA start error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // rpc ClientMfaFinish (ClientMfaFinishRequest) returns (ClientMfaFinishResponse) + Some(core_request::Payload::ClientMfaFinish(request)) => { + match client_mfa_server.finish_client_mfa_login(request).await { + Ok(response_payload) => { + Some(core_response::Payload::ClientMfaFinish(response_payload)) + } + Err(err) => { + error!("client MFA start error {err}"); + Some(core_response::Payload::CoreError(err.into())) + } + } + } + // Reply without payload. + None => None, + }; + let req = CoreResponse { + id: received.id, + payload, + }; + tx.send(req).unwrap(); + } + Err(err) => error!("stream error {err}"), + } + } + } +} + /// Runs gRPC server with core services. pub async fn run_grpc_server( config: &DefGuardConfig, @@ -321,18 +513,10 @@ pub async fn run_grpc_server( mail_tx: UnboundedSender, grpc_cert: Option, grpc_key: Option, - user_agent_parser: Arc, failed_logins: Arc>, ) -> Result<(), anyhow::Error> { // Build gRPC services let auth_service = AuthServiceServer::new(AuthServer::new(pool.clone(), failed_logins)); - let enrollment_service = EnrollmentServiceServer::new(EnrollmentServer::new( - pool.clone(), - wireguard_tx.clone(), - mail_tx.clone(), - user_agent_parser, - config.clone(), - )); #[cfg(feature = "worker")] let worker_service = WorkerServiceServer::with_interceptor( WorkerServer::new(pool.clone(), worker_state), @@ -345,7 +529,7 @@ pub async fn run_grpc_server( ); // Run gRPC server let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), config.grpc_port); - info!("Started gRPC services"); + info!("Starting gRPC services"); let builder = if let (Some(cert), Some(key)) = (grpc_cert, grpc_key) { let identity = Identity::from_pem(cert, key); Server::builder().tls_config(ServerTlsConfig::new().identity(identity))? @@ -355,7 +539,6 @@ pub async fn run_grpc_server( let builder = builder.http2_keepalive_interval(Some(Duration::from_secs(10))); let mut builder = builder.tcp_keepalive(Some(Duration::from_secs(10))); let router = builder.add_service(auth_service); - let router = router.add_service(enrollment_service); #[cfg(feature = "wireguard")] let router = router.add_service(gateway_service); #[cfg(feature = "worker")] diff --git a/src/grpc/password_reset.rs b/src/grpc/password_reset.rs new file mode 100644 index 000000000..2956d4335 --- /dev/null +++ b/src/grpc/password_reset.rs @@ -0,0 +1,232 @@ +use tokio::sync::mpsc::UnboundedSender; +use tonic::Status; + +use crate::{ + db::{ + models::enrollment::{Token, PASSWORD_RESET_TOKEN_TYPE}, + DbPool, User, + }, + handlers::{ + mail::{send_password_reset_email, send_password_reset_success_email}, + user::check_password_strength, + }, + ldap::utils::ldap_change_password, + mail::Mail, + SERVER_CONFIG, +}; + +use super::proto::{ + PasswordResetInitializeRequest, PasswordResetRequest, PasswordResetStartRequest, + PasswordResetStartResponse, +}; + +pub(super) struct PasswordResetServer { + pool: DbPool, + mail_tx: UnboundedSender, + // ldap_feature_active: bool, +} + +impl PasswordResetServer { + #[must_use] + pub fn new(pool: DbPool, mail_tx: UnboundedSender) -> Self { + // FIXME: check if LDAP feature is enabled + // let ldap_feature_active = true; + Self { + pool, + mail_tx, + // ldap_feature_active, + } + } + + // check if token provided with request corresponds to a valid enrollment session + async fn validate_session(&self, token: Option<&str>) -> Result { + let config = SERVER_CONFIG.get().expect("defguard config not found"); + let Some(token) = token else { + error!("Missing authorization header in request"); + return Err(Status::unauthenticated("Missing authorization header")); + }; + + debug!("Validating enrollment session token: {token}"); + let enrollment = Token::find_by_id(&self.pool, token).await?; + + if enrollment.is_session_valid(config.enrollment_session_timeout.as_secs()) { + Ok(enrollment) + } else { + error!("Enrollment session expired"); + Err(Status::unauthenticated("Enrollment session expired")) + } + } + + pub async fn request_password_reset( + &self, + request: PasswordResetInitializeRequest, + req_device_info: Option, + ) -> Result<(), Status> { + let config = SERVER_CONFIG.get().expect("defguard config not found"); + debug!("Starting password reset request"); + + let ip_address; + let user_agent; + if let Some(info) = req_device_info { + ip_address = info.ip_address.unwrap_or_default(); + user_agent = info.user_agent.unwrap_or_default(); + } else { + ip_address = String::new(); + user_agent = String::new(); + } + + let email = request.email; + + let user = User::find_by_email(&self.pool, email.to_string().as_str()) + .await + .map_err(|_| { + error!("Failed to fetch user by email"); + Status::internal("unexpected error") + })?; + + let Some(user) = user else { + // Do not return information whether user exists + return Ok(()); + }; + + // Do not allow password change if user is not active + if !user.has_password() { + return Ok(()); + } + + let mut transaction = self.pool.begin().await.map_err(|_| { + error!("Failed to begin transaction"); + Status::internal("unexpected error") + })?; + + Token::delete_unused_user_password_reset_tokens( + &mut transaction, + user.id.expect("Missing user ID"), + ) + .await?; + + let enrollment = Token::new( + user.id.expect("Missing user ID"), + None, + Some(email.clone()), + config.password_reset_token_timeout.as_secs(), + Some(PASSWORD_RESET_TOKEN_TYPE.to_string()), + ); + enrollment.save(&mut transaction).await?; + + transaction.commit().await.map_err(|_| { + error!("Failed to commit transaction"); + Status::internal("unexpected error") + })?; + + send_password_reset_email( + &user, + &self.mail_tx, + config.enrollment_url.clone(), + &enrollment.id, + Some(&ip_address), + Some(&user_agent), + )?; + + Ok(()) + } + + pub async fn start_password_reset( + &self, + request: PasswordResetStartRequest, + ) -> Result { + let config = SERVER_CONFIG.get().expect("defguard config not found"); + debug!("Starting password reset session: {request:?}"); + + let mut enrollment = Token::find_by_id(&self.pool, &request.token).await?; + + if enrollment.token_type != Some("PASSWORD_RESET".to_string()) { + return Err(Status::permission_denied("invalid token")); + } + + let user = enrollment.fetch_user(&self.pool).await?; + + if !user.has_password() { + return Err(Status::permission_denied("user inactive")); + } + + let mut transaction = self.pool.begin().await.map_err(|_| { + error!("Failed to begin transaction"); + Status::internal("unexpected error") + })?; + + let session_deadline = enrollment + .start_session( + &mut transaction, + config.password_reset_session_timeout.as_secs(), + ) + .await?; + + let response = PasswordResetStartResponse { + deadline_timestamp: session_deadline.timestamp(), + }; + + transaction.commit().await.map_err(|_| { + error!("Failed to commit transaction"); + Status::internal("unexpected error") + })?; + + Ok(response) + } + + pub async fn reset_password( + &self, + request: PasswordResetRequest, + req_device_info: Option, + ) -> Result<(), Status> { + debug!("Starting password reset: {request:?}"); + let enrollment = self.validate_session(request.token.as_deref()).await?; + + let ip_address; + let user_agent; + if let Some(info) = req_device_info { + ip_address = info.ip_address.unwrap_or_default(); + user_agent = info.user_agent.unwrap_or_default(); + } else { + ip_address = String::new(); + user_agent = String::new(); + } + + if let Err(err) = check_password_strength(&request.password) { + error!("Password not strong enough: {err}"); + return Err(Status::invalid_argument("password not strong enough")); + } + + let mut user = enrollment.fetch_user(&self.pool).await?; + + let mut transaction = self.pool.begin().await.map_err(|_| { + error!("Failed to begin transaction"); + Status::internal("unexpected error") + })?; + + // update user + user.set_password(&request.password); + user.save(&mut *transaction).await.map_err(|err| { + error!("Failed to update user {}: {err}", user.username); + Status::internal("unexpected error") + })?; + + // if self.ldap_feature_active { + let _ = ldap_change_password(&self.pool, &user.username, &request.password).await; + // }; + + transaction.commit().await.map_err(|_| { + error!("Failed to commit transaction"); + Status::internal("unexpected error") + })?; + + send_password_reset_success_email( + &user, + &self.mail_tx, + Some(&ip_address), + Some(&user_agent), + )?; + + Ok(()) + } +} diff --git a/src/handlers/auth.rs b/src/handlers/auth.rs index 68f01d871..7d6520664 100644 --- a/src/handlers/auth.rs +++ b/src/handlers/auth.rs @@ -1,17 +1,19 @@ use axum::{ extract::{Json, State}, - headers::UserAgent, http::StatusCode, - TypedHeader, }; use axum_client_ip::{InsecureClientIp, LeftmostXForwardedFor}; -use secrecy::ExposeSecret; +use axum_extra::{ + extract::{ + cookie::{Cookie, CookieJar, SameSite}, + PrivateCookieJar, + }, + headers::UserAgent, + TypedHeader, +}; use serde_json::json; use sqlx::types::Uuid; -use tower_cookies::{ - cookie::{time::Duration, SameSite}, - Cookie, Cookies, Key, -}; +use time::Duration; use webauthn_rs::prelude::PublicKeyCredential; use webauthn_rs_proto::options::CollectedClientData; @@ -40,42 +42,41 @@ use crate::{ /// * 200 with MFA disabled /// * 201 with MFA enabled when additional authentication factor is required pub async fn authenticate( - cookies: Cookies, + cookies: CookieJar, + private_cookies: PrivateCookieJar, user_agent: Option>, forwarded_for_ip: Option, InsecureClientIp(insecure_ip): InsecureClientIp, State(appstate): State, Json(data): Json, -) -> ApiResult { - let lowercase_username = data.username.to_lowercase(); - debug!("Authenticating user {lowercase_username}"); +) -> Result<(CookieJar, PrivateCookieJar, ApiResponse), WebError> { + let username = data.username; + debug!("Authenticating user {username}"); // check if user can proceed with login - check_username(&appstate.failed_logins, &lowercase_username)?; + check_username(&appstate.failed_logins, &username)?; - let user = match User::find_by_username(&appstate.pool, &lowercase_username).await { + let user = match User::find_by_username(&appstate.pool, &username).await { Ok(Some(user)) => match user.verify_password(&data.password) { Ok(()) => user, Err(err) => { - info!("Failed to authenticate user {lowercase_username}: {err}"); - log_failed_login_attempt(&appstate.failed_logins, &lowercase_username); + info!("Failed to authenticate user {username}: {err}"); + log_failed_login_attempt(&appstate.failed_logins, &username); return Err(WebError::Authorization(err.to_string())); } }, Ok(None) => { // create user from LDAP - debug!("User not found in DB, authenticating user {lowercase_username} with LDAP"); - if let Ok(user) = - user_from_ldap(&appstate.pool, &lowercase_username, &data.password).await - { + debug!("User not found in DB, authenticating user {username} with LDAP"); + if let Ok(user) = user_from_ldap(&appstate.pool, &username, &data.password).await { user } else { - info!("Failed to authenticate user {lowercase_username} with LDAP"); - log_failed_login_attempt(&appstate.failed_logins, &lowercase_username); + info!("Failed to authenticate user {username} with LDAP"); + log_failed_login_attempt(&appstate.failed_logins, &username); return Err(WebError::Authorization("user not found".into())); } } Err(err) => { - error!("DB error when authenticating user {lowercase_username}: {err}"); + error!("DB error when authenticating user {username}: {err}"); return Err(WebError::DbError(err.to_string())); } }; @@ -103,7 +104,7 @@ pub async fn authenticate( }; let server_config = SERVER_CONFIG.get().ok_or(WebError::ServerConfigMissing)?; - let auth_cookie = Cookie::build(SESSION_COOKIE_NAME, session.clone().id) + let auth_cookie = Cookie::build((SESSION_COOKIE_NAME, session.id.clone())) .domain( server_config .cookie_domain @@ -114,13 +115,12 @@ pub async fn authenticate( .http_only(true) .secure(!server_config.cookie_insecure) .same_site(SameSite::Lax) - .max_age(max_age) - .finish(); - cookies.add(auth_cookie); + .max_age(max_age); + let cookies = cookies.add(auth_cookie); let login_event_type = "AUTHENTICATION".to_string(); - info!("Authenticated user {lowercase_username}"); + info!("Authenticated user {username}"); if user.mfa_enabled { if let Some(mfa_info) = MFAInfo::for_user(&appstate.pool, &user).await? { check_new_device_login( @@ -133,17 +133,19 @@ pub async fn authenticate( agent, ) .await?; - Ok(ApiResponse { - json: json!(mfa_info), - status: StatusCode::CREATED, - }) + Ok(( + cookies, + private_cookies, + ApiResponse { + json: json!(mfa_info), + status: StatusCode::CREATED, + }, + )) } else { Err(WebError::DbError("MFA info read error".into())) } } else { let user_info = UserInfo::from_user(&appstate.pool, &user).await?; - let key = Key::from(server_config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); check_new_device_login( &appstate.pool, @@ -159,59 +161,66 @@ pub async fn authenticate( if let Some(openid_cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { debug!("Found openid session cookie."); let redirect_url = openid_cookie.value().to_string(); - private_cookies.remove(openid_cookie); - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: Some(redirect_url) - }), - status: StatusCode::OK, - }) + Ok(( + cookies, + private_cookies.remove(openid_cookie), + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: Some(redirect_url) + }), + status: StatusCode::OK, + }, + )) } else { - debug!("No openid session found"); - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: None, - }), - status: StatusCode::OK, - }) + debug!("No OpenID session found"); + Ok(( + cookies, + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: None, + }), + status: StatusCode::OK, + }, + )) } } } /// Logout - forget the session cookie. pub async fn logout( - cookies: Cookies, + cookies: CookieJar, session: Session, State(appstate): State, -) -> ApiResult { +) -> Result<(CookieJar, ApiResponse), WebError> { // remove auth cookie - cookies.remove(Cookie::named(SESSION_COOKIE_NAME)); + let cookies = cookies.remove(Cookie::from(SESSION_COOKIE_NAME)); // remove stored session session.delete(&appstate.pool).await?; - Ok(ApiResponse::default()) + Ok((cookies, ApiResponse::default())) } /// Enable MFA pub async fn mfa_enable( - cookies: Cookies, + cookies: CookieJar, session: Session, session_info: SessionInfo, State(appstate): State, -) -> ApiResult { +) -> Result<(CookieJar, ApiResponse), WebError> { let mut user = session_info.user; debug!("Enabling MFA for user {}", user.username); user.enable_mfa(&appstate.pool).await?; if user.mfa_enabled { info!("Enabled MFA for user {}", user.username); - cookies.remove(Cookie::named("defguard_sesssion")); + let cookies = cookies.remove(Cookie::from("defguard_sesssion")); session.delete(&appstate.pool).await?; debug!( "Removed auth session for user {} after enabling MFA", user.username ); - Ok(ApiResponse::default()) + Ok((cookies, ApiResponse::default())) } else { error!("Error enabling MFA for user {}", user.username); Err(WebError::Http(StatusCode::NOT_MODIFIED)) @@ -351,11 +360,11 @@ pub async fn webauthn_start(mut session: Session, State(appstate): State, Json(pubkey): Json, -) -> ApiResult { +) -> Result<(PrivateCookieJar, ApiResponse), WebError> { if let Some(passkey_auth) = session.get_passkey_authentication() { if let Ok(auth_result) = appstate .webauthn @@ -374,30 +383,34 @@ pub async fn webauthn_end( .await?; return if let Some(user) = User::find_by_id(&appstate.pool, session.user_id).await? { let user_info = UserInfo::from_user(&appstate.pool, &user).await?; - let key = Key::from(appstate.config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); if let Some(openid_cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { debug!("Found OpenID session cookie."); let redirect_url = openid_cookie.value().to_string(); - private_cookies.remove(openid_cookie); - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: Some(redirect_url), - }), - status: StatusCode::OK, - }) + let private_cookies = private_cookies.remove(openid_cookie); + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: Some(redirect_url), + }), + status: StatusCode::OK, + }, + )) } else { - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: None, - }), - status: StatusCode::OK, - }) + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: None, + }), + status: StatusCode::OK, + }, + )) } } else { - Ok(ApiResponse::default()) + Ok((private_cookies, ApiResponse::default())) }; } } @@ -461,11 +474,11 @@ pub async fn totp_disable(session: SessionInfo, State(appstate): State /// Validate one-time passcode pub async fn totp_code( - cookies: Cookies, + private_cookies: PrivateCookieJar, mut session: Session, State(appstate): State, Json(data): Json, -) -> ApiResult { +) -> Result<(PrivateCookieJar, ApiResponse), WebError> { if let Some(user) = User::find_by_id(&appstate.pool, session.user_id).await? { let username = user.username.clone(); debug!("Verifying TOTP for user {}", username); @@ -475,27 +488,31 @@ pub async fn totp_code( .await?; let user_info = UserInfo::from_user(&appstate.pool, &user).await?; info!("Verified TOTP for user {username}"); - let key = Key::from(appstate.config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); if let Some(openid_cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { debug!("Found openid session cookie."); let redirect_url = openid_cookie.value().to_string(); - private_cookies.remove(openid_cookie); - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: Some(redirect_url), - }), - status: StatusCode::OK, - }) + let private_cookies = private_cookies.remove(openid_cookie); + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: Some(redirect_url), + }), + status: StatusCode::OK, + }, + )) } else { - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: None, - }), - status: StatusCode::OK, - }) + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: None, + }), + status: StatusCode::OK, + }, + )) } } else { Err(WebError::Authorization("Invalid TOTP code".into())) @@ -579,7 +596,7 @@ pub async fn request_email_mfa_code( if let Some(user) = User::find_by_id(&appstate.pool, session.user_id).await? { debug!("Sending email MFA code for user {}", user.username); if user.email_mfa_enabled { - send_email_mfa_code_email(&user, &appstate.mail_tx, &session)?; + send_email_mfa_code_email(&user, &appstate.mail_tx, Some(&session))?; info!("Sent email MFA code for user {}", user.username); Ok(ApiResponse::default()) } else { @@ -592,11 +609,11 @@ pub async fn request_email_mfa_code( /// Validate email MFA code pub async fn email_mfa_code( - cookies: Cookies, + private_cookies: PrivateCookieJar, mut session: Session, State(appstate): State, Json(data): Json, -) -> ApiResult { +) -> Result<(PrivateCookieJar, ApiResponse), WebError> { if let Some(user) = User::find_by_id(&appstate.pool, session.user_id).await? { let username = user.username.clone(); debug!("Verifying email MFA code for user {}", username); @@ -606,27 +623,31 @@ pub async fn email_mfa_code( .await?; let user_info = UserInfo::from_user(&appstate.pool, &user).await?; info!("Verified email MFA code for user {username}"); - let key = Key::from(appstate.config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); if let Some(openid_cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { debug!("Found openid session cookie."); let redirect_url = openid_cookie.value().to_string(); - private_cookies.remove(openid_cookie); - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: Some(redirect_url), - }), - status: StatusCode::OK, - }) + let private_cookies = private_cookies.remove(openid_cookie); + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: Some(redirect_url), + }), + status: StatusCode::OK, + }, + )) } else { - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: None, - }), - status: StatusCode::OK, - }) + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: None, + }), + status: StatusCode::OK, + }, + )) } } else { Err(WebError::Authorization("Invalid email MFA code".into())) @@ -661,11 +682,11 @@ pub async fn web3auth_start( /// Finish Web3 authentication pub async fn web3auth_end( - cookies: Cookies, + private_cookies: PrivateCookieJar, mut session: Session, State(appstate): State, Json(signature): Json, -) -> ApiResult { +) -> Result<(PrivateCookieJar, ApiResponse), WebError> { debug!( "Finishing web3 authentication for wallet {}", signature.address @@ -687,34 +708,37 @@ pub async fn web3auth_end( let username = user.username.clone(); let user_info = UserInfo::from_user(&appstate.pool, &user).await?; info!( - "User {} authenticated with wallet {}", - username, signature.address + "User {username} authenticated with wallet {}", + signature.address ); - let key = - Key::from(appstate.config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); if let Some(openid_cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { debug!("Found openid session cookie."); let redirect_url = openid_cookie.value().to_string(); - private_cookies.remove(openid_cookie); - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: Some(redirect_url), - }), - status: StatusCode::OK, - }) + let private_cookies = private_cookies.remove(openid_cookie); + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: Some(redirect_url), + }), + status: StatusCode::OK, + }, + )) } else { - Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: None, - }), - status: StatusCode::OK, - }) + Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: None, + }), + status: StatusCode::OK, + }, + )) } } else { - Ok(ApiResponse::default()) + Ok((private_cookies, ApiResponse::default())) } } _ => Err(WebError::Authorization("Signature not verified".into())), @@ -727,11 +751,11 @@ pub async fn web3auth_end( /// Authenticate with a recovery code. pub async fn recovery_code( - cookies: Cookies, + private_cookies: PrivateCookieJar, mut session: Session, State(appstate): State, Json(recovery_code): Json, -) -> ApiResult { +) -> Result<(PrivateCookieJar, ApiResponse), WebError> { if let Some(mut user) = User::find_by_id(&appstate.pool, session.user_id).await? { let username = user.username.clone(); debug!("Authenticating user {} with recovery code", username); @@ -744,28 +768,32 @@ pub async fn recovery_code( .await?; let user_info = UserInfo::from_user(&appstate.pool, &user).await?; info!("Authenticated user {username} with recovery code"); - let key = Key::from(appstate.config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); if let Some(openid_cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { debug!("Found OpenID session cookie."); let redirect_url = openid_cookie.value().to_string(); - private_cookies.remove(openid_cookie); - return Ok(ApiResponse { + let private_cookies = private_cookies.remove(openid_cookie); + return Ok(( + private_cookies, + ApiResponse { + json: json!(AuthResponse { + user: user_info, + url: Some(redirect_url), + }), + status: StatusCode::OK, + }, + )); + } + + return Ok(( + private_cookies, + ApiResponse { json: json!(AuthResponse { user: user_info, - url: Some(redirect_url), + url: None, }), status: StatusCode::OK, - }); - } - - return Ok(ApiResponse { - json: json!(AuthResponse { - user: user_info, - url: None, - }), - status: StatusCode::OK, - }); + }, + )); } } Err(WebError::Http(StatusCode::UNAUTHORIZED)) diff --git a/src/handlers/forward_auth.rs b/src/handlers/forward_auth.rs index 2f6c4a4a0..d5ceb74e4 100644 --- a/src/handlers/forward_auth.rs +++ b/src/handlers/forward_auth.rs @@ -4,8 +4,8 @@ use axum::{ http::{header::HeaderValue, request::Parts, StatusCode}, response::{IntoResponse, Redirect, Response}, }; +use axum_extra::extract::cookie::CookieJar; use reqwest::Url; -use tower_cookies::Cookies; use super::SESSION_COOKIE_NAME; use crate::{appstate::AppState, db::Session, error::WebError, SERVER_CONFIG}; @@ -61,7 +61,7 @@ impl FromRequestParts for ForwardAuthHeaders { pub async fn forward_auth( State(appstate): State, - cookies: Cookies, + cookies: CookieJar, headers: ForwardAuthHeaders, ) -> Result { // check if session cookie is present diff --git a/src/handlers/group.rs b/src/handlers/group.rs index 179d6d328..afa4d96eb 100644 --- a/src/handlers/group.rs +++ b/src/handlers/group.rs @@ -4,17 +4,17 @@ use axum::{ }; use serde_json::json; -use super::{ApiResponse, ApiResult, Username}; +use super::{ApiResponse, GroupInfo, Username}; use crate::{ appstate::AppState, - auth::{AdminRole, SessionInfo}, + auth::{SessionInfo, UserAdminRole}, db::{Group, User}, error::WebError, - ldap::utils::{ldap_add_user_to_group, ldap_remove_user_from_group}, + // ldap::utils::{ldap_add_user_to_group, ldap_modify_group, ldap_remove_user_from_group}, }; #[derive(Serialize)] -pub struct Groups { +pub(crate) struct Groups { groups: Vec, } @@ -25,20 +25,11 @@ impl Groups { } } -#[derive(Serialize)] -pub struct GroupInfo { - name: String, - members: Vec, -} - -impl GroupInfo { - #[must_use] - pub fn new(name: String, members: Vec) -> Self { - Self { name, members } - } -} - -pub async fn list_groups(_session: SessionInfo, State(appstate): State) -> ApiResult { +/// GET: Retrieve all groups. +pub(crate) async fn list_groups( + _session: SessionInfo, + State(appstate): State, +) -> Result { debug!("Listing groups"); let groups = Group::all(&appstate.pool) .await? @@ -52,36 +43,165 @@ pub async fn list_groups(_session: SessionInfo, State(appstate): State }) } -pub async fn get_group( +/// GET: Retrieve group with `name`. +pub(crate) async fn get_group( _session: SessionInfo, State(appstate): State, Path(name): Path, -) -> ApiResult { +) -> Result { debug!("Retrieving group {name}"); if let Some(group) = Group::find_by_name(&appstate.pool, &name).await? { let members = group.member_usernames(&appstate.pool).await?; info!("Retrieved group {name}"); Ok(ApiResponse { - json: json!(GroupInfo::new(name, members)), + json: json!(GroupInfo::new(name, Some(members))), status: StatusCode::OK, }) } else { - error!("Group {name} not found"); - Err(WebError::ObjectNotFound(format!("Group {name} not found",))) + let msg = format!("Group {name} not found"); + error!(msg); + Err(WebError::ObjectNotFound(msg)) } } -pub async fn add_group_member( - _admin: AdminRole, +/// POST: Create group with a given name and member list. +pub(crate) async fn create_group( + _role: UserAdminRole, + State(appstate): State, + Json(group_info): Json, +) -> Result { + debug!("Creating group {}", group_info.name); + + // FIXME: LDAP operations are not reverted. + let mut transaction = appstate.pool.begin().await?; + + let mut group = Group::new(&group_info.name); + // FIXME: conflicts must not return interal server error (500). + group.save(&appstate.pool).await?; + // TODO: create group in LDAP + + if let Some(ref members) = group_info.members { + for username in members { + let Some(user) = User::find_by_username(&mut *transaction, username).await? else { + let msg = format!("Failed to find user {username}"); + error!(msg); + return Err(WebError::ObjectNotFound(msg)); + }; + user.add_to_group(&mut *transaction, &group).await?; + // let _result = ldap_add_user_to_group(&mut *transaction, username, &group.name).await; + } + } + + transaction.commit().await?; + + info!("Created group {}", group_info.name); + Ok(ApiResponse { + json: json!(group_info), + status: StatusCode::CREATED, + }) +} + +/// PUT: Rename group and/or change group members. +pub(crate) async fn modify_group( + _role: UserAdminRole, + State(appstate): State, + Path(name): Path, + Json(group_info): Json, +) -> Result { + debug!("Modifying group {}", group_info.name); + let Some(mut group) = Group::find_by_name(&appstate.pool, &name).await? else { + let msg = format!("Group {name} not found"); + error!(msg); + return Err(WebError::ObjectNotFound(msg)); + }; + + // FIXME: LDAP operations are not reverted. + let mut transaction = appstate.pool.begin().await?; + + // Rename only when needed. + if group.name != group_info.name { + group.name = group_info.name; + group.save(&mut *transaction).await?; + // let _result = ldap_modify_group(&mut *transaction, &group.name, &group).await; + } + + // Modify group members. + if let Some(ref members) = group_info.members { + let mut current_members = group.members(&mut *transaction).await?; + for username in members { + if let Some(index) = current_members + .iter() + .position(|gm| &gm.username == username) + { + // This member is already in the group. + current_members.remove(index); + continue; + } + + // Add new members to the group. + if let Some(user) = User::find_by_username(&mut *transaction, username).await? { + user.add_to_group(&mut *transaction, &group).await?; + // let _result = + // ldap_add_user_to_group(&mut *transaction, username, &group.name).await; + } + } + + // Remove outstanding members. + for user in current_members { + user.remove_from_group(&mut *transaction, &group).await?; + // let _result = + // ldap_remove_user_from_group(&mut *transaction, &user.username, &group.name).await; + } + } + + transaction.commit().await?; + + info!("Modified group {}", group.name); + Ok(ApiResponse::default()) +} + +/// DELETE: Remove group with `name`. +pub(crate) async fn delete_group( + _session: SessionInfo, + + State(appstate): State, + Path(name): Path, +) -> Result { + debug!("Deleting group {name}"); + // Administrative group must not be removed. + // Note: Group names are unique, so this condition should be sufficient. + if name == appstate.config.admin_groupname { + return Ok(ApiResponse { + json: json!({}), + status: StatusCode::BAD_REQUEST, + }); + } + + if let Some(group) = Group::find_by_name(&appstate.pool, &name).await? { + group.delete(&appstate.pool).await?; + // TODO: delete group from LDAP + + info!("Deleted group {name}"); + Ok(ApiResponse::default()) + } else { + let msg = format!("Failed to find group {name}"); + error!(msg); + Err(WebError::ObjectNotFound(msg)) + } +} + +/// POST: Find a group with `name` and add `username` as a member. +pub(crate) async fn add_group_member( + _role: UserAdminRole, State(appstate): State, Path(name): Path, Json(data): Json, -) -> ApiResult { +) -> Result { if let Some(group) = Group::find_by_name(&appstate.pool, &name).await? { if let Some(user) = User::find_by_username(&appstate.pool, &data.username).await? { debug!("Adding user: {} to group: {}", user.username, group.name); user.add_to_group(&appstate.pool, &group).await?; - let _result = ldap_add_user_to_group(&appstate.pool, &user.username, &group.name).await; + // let _result = ldap_add_user_to_group(&appstate.pool, &user.username, &group.name).await; info!("Added user: {} to group: {}", user.username, group.name); Ok(ApiResponse::default()) } else { @@ -92,16 +212,18 @@ pub async fn add_group_member( ))) } } else { - error!("Group {name} not found"); - Err(WebError::ObjectNotFound(format!("Group {name} not found"))) + let msg = format!("Group {name} not found"); + error!(msg); + Err(WebError::ObjectNotFound(msg)) } } -pub async fn remove_group_member( - _admin: AdminRole, +/// DELETE: Remove `username` from group with `name`. +pub(crate) async fn remove_group_member( + _role: UserAdminRole, State(appstate): State, Path((name, username)): Path<(String, String)>, -) -> ApiResult { +) -> Result { if let Some(group) = Group::find_by_name(&appstate.pool, &name).await? { if let Some(user) = User::find_by_username(&appstate.pool, &username).await? { debug!( @@ -109,18 +231,17 @@ pub async fn remove_group_member( user.username, group.name ); user.remove_from_group(&appstate.pool, &group).await?; - let _result = - ldap_remove_user_from_group(&appstate.pool, &user.username, &group.name).await; + // let _result = + // ldap_remove_user_from_group(&appstate.pool, &user.username, &group.name).await; info!("Removed user: {} from group: {}", user.username, group.name); Ok(ApiResponse { json: json!({}), status: StatusCode::OK, }) } else { - error!("User not found {username}"); - Err(WebError::ObjectNotFound(format!( - "User {username} not found" - ))) + let msg = format!("User {username} not found"); + error!(msg); + Err(WebError::ObjectNotFound(msg)) } } else { error!("Group {name} not found"); diff --git a/src/handlers/mail.rs b/src/handlers/mail.rs index 6729a28e6..73c8e1cc9 100644 --- a/src/handlers/mail.rs +++ b/src/handlers/mail.rs @@ -6,6 +6,7 @@ use axum::{ }; use chrono::{NaiveDateTime, Utc}; use lettre::message::header::ContentType; +use reqwest::Url; use serde_json::json; use tokio::{ fs::read_to_string, @@ -17,7 +18,7 @@ use crate::{ appstate::AppState, auth::{AdminRole, SessionInfo}, config::DefGuardConfig, - db::{MFAMethod, Session, User}, + db::{models::enrollment::TokenError, MFAMethod, Session, User}, error::WebError, mail::{Attachment, Mail}, support::dump_config, @@ -37,6 +38,9 @@ static EMAIL_MFA_CODE_EMAIL_SUBJECT: &str = "Your Multi-Factor Authentication Co static GATEWAY_DISCONNECTED: &str = "Defguard: Gateway disconnected"; +pub static EMAIL_PASSOWRD_RESET_START_SUBJECT: &str = "Defguard: Password reset"; +pub static EMAIL_PASSOWRD_RESET_SUCCESS_SUBJECT: &str = "Defguard: Password reset success"; + #[derive(Clone, Deserialize)] pub struct TestMail { pub to: String, @@ -165,14 +169,14 @@ pub async fn send_support_data( } } -pub async fn send_new_device_added_email( +pub fn send_new_device_added_email( device_name: &str, public_key: &str, - template_locations: &Vec, + template_locations: &[TemplateLocation], user_email: &str, mail_tx: &UnboundedSender, - ip_address: Option, - device_info: Option, + ip_address: Option<&str>, + device_info: Option<&str>, ) -> Result<(), TemplateError> { debug!("User {user_email} new device added mail to {SUPPORT_EMAIL_ADDRESS}"); @@ -203,10 +207,11 @@ pub async fn send_new_device_added_email( } } } + pub async fn send_gateway_disconnected_email( gateway_name: Option, network_name: String, - gateway_adress: String, + gateway_adress: &str, mail_tx: &UnboundedSender, pool: &DbPool, ) -> Result<(), WebError> { @@ -216,14 +221,14 @@ pub async fn send_gateway_disconnected_email( .ok_or(WebError::ServerConfigMissing)? .admin_groupname; let admin_users = User::find_by_group_name(pool, admin_group_name).await?; - let gateway_name = gateway_name.unwrap_or("".into()); - for user in admin_users.into_iter() { + let gateway_name = gateway_name.unwrap_or_default(); + for user in admin_users { let mail = Mail { to: user.email, subject: GATEWAY_DISCONNECTED.to_string(), content: templates::gateway_disconnected_mail( &gateway_name, - &gateway_adress, + gateway_adress, &network_name, )?, attachments: Vec::new(), @@ -232,13 +237,12 @@ pub async fn send_gateway_disconnected_email( let to = mail.to.clone(); match mail_tx.send(mail) { - Ok(_) => { - info!("Sent gateway disconnected notification to {}", &to); + Ok(()) => { + info!("Sent gateway disconnected notification to {to}"); } Err(err) => { error!( - "Sending gateway disconnected notification to {} failed with error:\n{}", - &to, &err + "Sending gateway disconnected notification to {to} failed with error:\n{err}" ); } } @@ -381,7 +385,7 @@ pub fn send_email_mfa_activation_email( pub fn send_email_mfa_code_email( user: &User, mail_tx: &UnboundedSender, - session: &Session, + session: Option<&Session>, ) -> Result<(), TemplateError> { debug!("Sending email MFA code mail to {}", user.email); @@ -412,3 +416,64 @@ pub fn send_email_mfa_code_email( } } } + +pub fn send_password_reset_email( + user: &User, + mail_tx: &UnboundedSender, + service_url: Url, + token: &str, + ip_address: Option<&str>, + device_info: Option<&str>, +) -> Result<(), TokenError> { + debug!("Sending password reset email to {}", user.email); + + let mail = Mail { + to: user.email.clone(), + subject: EMAIL_PASSOWRD_RESET_START_SUBJECT.into(), + content: templates::email_password_reset_mail(service_url, token, ip_address, device_info)?, + attachments: Vec::new(), + result_tx: None, + }; + + let to = mail.to.clone(); + + match mail_tx.send(mail) { + Ok(()) => { + info!("Password reset email sent to {to}"); + Ok(()) + } + Err(err) => { + error!("Failed to send password reset email to {to} with error:\n{err}"); + Err(TokenError::NotificationError(err.to_string())) + } + } +} + +pub fn send_password_reset_success_email( + user: &User, + mail_tx: &UnboundedSender, + ip_address: Option<&str>, + device_info: Option<&str>, +) -> Result<(), TokenError> { + debug!("Sending password reset success email to {}", user.email); + + let mail = Mail { + to: user.email.clone(), + subject: EMAIL_PASSOWRD_RESET_SUCCESS_SUBJECT.into(), + content: templates::email_password_reset_success_mail(ip_address, device_info)?, + attachments: Vec::new(), + result_tx: None, + }; + + let to = mail.to.clone(); + + match mail_tx.send(mail) { + Ok(()) => { + info!("Password reset email success sent to {to}"); + } + Err(err) => { + error!("Failed to send password reset success email to {to} with error:\n{err}"); + } + } + Ok(()) +} diff --git a/src/handlers/mod.rs b/src/handlers/mod.rs index a3ce53569..f836b0a5b 100644 --- a/src/handlers/mod.rs +++ b/src/handlers/mod.rs @@ -34,7 +34,7 @@ pub mod wireguard; #[cfg(feature = "worker")] pub mod worker; -static SESSION_COOKIE_NAME: &str = "defguard_session"; +pub(crate) static SESSION_COOKIE_NAME: &str = "defguard_session"; static SIGN_IN_COOKIE_NAME: &str = "defguard_sign_in"; #[derive(Default)] @@ -57,11 +57,11 @@ impl From for ApiResponse { ApiResponse::new(json!({ "msg": msg }), StatusCode::NOT_FOUND) } WebError::Authorization(msg) => { - error!("{msg}"); + error!(msg); ApiResponse::new(json!({ "msg": msg }), StatusCode::UNAUTHORIZED) } WebError::Forbidden(msg) => { - error!("{msg}"); + error!(msg); ApiResponse::new(json!({ "msg": msg }), StatusCode::FORBIDDEN) } WebError::DbError(_) @@ -92,7 +92,7 @@ impl From for ApiResponse { WebError::IncorrectUsername(msg) | WebError::PubkeyValidation(msg) | WebError::BadRequest(msg) => { - error!("{msg}"); + error!(msg); ApiResponse::new(json!({ "msg": msg }), StatusCode::BAD_REQUEST) } WebError::TemplateError(err) => { @@ -135,8 +135,11 @@ pub struct Auth { impl Auth { #[must_use] - pub fn new(username: String, password: String) -> Self { - Self { username, password } + pub fn new>(username: S, password: S) -> Self { + Self { + username: username.into(), + password: password.into(), + } } } @@ -147,8 +150,10 @@ pub struct AuthTotp { impl AuthTotp { #[must_use] - pub fn new(secret: String) -> Self { - Self { secret } + pub fn new>(secret: S) -> Self { + Self { + secret: secret.into(), + } } } @@ -164,6 +169,22 @@ impl AuthCode { } } +#[derive(Deserialize, Serialize)] +pub struct GroupInfo { + pub name: String, + pub members: Option>, +} + +impl GroupInfo { + #[must_use] + pub fn new>(name: S, members: Option>) -> Self { + Self { + name: name.into(), + members, + } + } +} + #[derive(Deserialize, Serialize)] pub struct Username { pub username: String, diff --git a/src/handlers/openid_flow.rs b/src/handlers/openid_flow.rs index 55a310757..741fe31c3 100644 --- a/src/handlers/openid_flow.rs +++ b/src/handlers/openid_flow.rs @@ -9,6 +9,7 @@ use axum::{ http::{header::LOCATION, request::Parts, HeaderMap, HeaderValue, StatusCode}, Form, }; +use axum_extra::extract::cookie::{Cookie, CookieJar, PrivateCookieJar, SameSite}; use base64::{prelude::BASE64_STANDARD, Engine}; use chrono::Utc; use openidconnect::{ @@ -26,18 +27,14 @@ use openidconnect::{ PrivateSigningKey, RefreshToken, ResponseTypes, Scope, StandardClaims, StandardErrorResponse, StandardTokenResponse, SubjectIdentifier, TokenUrl, UserInfoUrl, }; -use secrecy::ExposeSecret; use serde::{ de::{Deserialize, Deserializer, Error as DeError, Unexpected, Visitor}, ser::{Serialize, Serializer}, }; use serde_json::json; -use tower_cookies::{ - cookie::{time::Duration, SameSite}, - Cookie, Cookies, Key, -}; +use time::Duration; -use super::{ApiResponse, ApiResult}; +use super::{ApiResponse, ApiResult, SESSION_COOKIE_NAME}; use crate::{ appstate::AppState, auth::{AccessUserInfo, SessionInfo, SESSION_TIMEOUT}, @@ -224,7 +221,7 @@ impl AuthenticationRequest { if self .scope .split(' ') - .all(|scope| !oauth2client.scope.contains(&scope.to_owned())) + .all(|scope| !oauth2client.scope.iter().any(|s| s == scope)) { error!( "Invalid scope for client {}: {}", @@ -247,15 +244,14 @@ impl AuthenticationRequest { // check `redirect_uri` matches client config (ignoring trailing slashes) let parsed_redirect_uris: Vec = oauth2client .redirect_uri - .clone() - .into_iter() + .iter() .map(|uri| uri.trim_end_matches('/').into()) .collect(); if self .redirect_uri .split(' ') .map(|uri| uri.trim_end_matches('/')) - .all(|uri| !parsed_redirect_uris.contains(&uri.to_owned())) + .all(|uri| !parsed_redirect_uris.iter().any(|u| u == uri)) { error!( "Invalid redirect_uri for client {}: {} not in [{}]", @@ -313,28 +309,34 @@ async fn generate_auth_code_redirect( } /// Helper function to return redirection with status code 302. -fn redirect_to>(uri: T) -> (StatusCode, HeaderMap) { +fn redirect_to>( + uri: T, + private_cookies: PrivateCookieJar, +) -> (StatusCode, HeaderMap, PrivateCookieJar) { let mut headers = HeaderMap::new(); headers.insert( LOCATION, HeaderValue::try_from(uri.as_ref()).expect("URI isn't a valid header value"), ); - (StatusCode::FOUND, headers) + (StatusCode::FOUND, headers, private_cookies) } /// Helper function to redirect unauthorized user to login page /// and store information about OpenID authorize url in cookie to redirect later async fn login_redirect( data: &AuthenticationRequest, - cookies: Cookies, -) -> Result<(StatusCode, HeaderMap), WebError> { + private_cookies: PrivateCookieJar, +) -> Result<(StatusCode, HeaderMap, PrivateCookieJar), WebError> { let server_config = SERVER_CONFIG.get().ok_or(WebError::ServerConfigMissing)?; let base_url = server_config.url.join("api/v1/oauth/authorize").unwrap(); - let cookie = Cookie::build( + let cookie = Cookie::build(( SIGN_IN_COOKIE_NAME, - format!("{base_url}?{}", serde_urlencoded::to_string(data).unwrap()), - ) + format!( + "{base_url}?{}", + serde_urlencoded::to_string(data).unwrap_or_default() + ), + )) .domain( server_config .cookie_domain @@ -345,12 +347,8 @@ async fn login_redirect( .secure(!server_config.cookie_insecure) .same_site(SameSite::Lax) .http_only(true) - .max_age(Duration::minutes(10)) - .finish(); - let key = Key::from(server_config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); - private_cookies.add(cookie); - Ok(redirect_to("/login")) + .max_age(Duration::minutes(10)); + Ok(redirect_to("/login", private_cookies.add(cookie))) } /// Authorization Endpoint @@ -358,8 +356,9 @@ async fn login_redirect( pub async fn authorization( State(appstate): State, Query(data): Query, - cookies: Cookies, -) -> Result<(StatusCode, HeaderMap), WebError> { + cookies: CookieJar, + private_cookies: PrivateCookieJar, +) -> Result<(StatusCode, HeaderMap, PrivateCookieJar), WebError> { let error; if let Some(oauth2client) = OAuth2Client::find_by_client_id(&appstate.pool, &data.client_id).await? @@ -372,17 +371,18 @@ pub async fn authorization( "Redirecting user to consent form - client id {}", data.client_id ); - return Ok(redirect_to(format!( - "/consent?{}", - serde_urlencoded::to_string(data).unwrap(), - ))); + // FIXME: do not panic + return Ok(redirect_to( + format!("/consent?{}", serde_urlencoded::to_string(data).unwrap(),), + private_cookies, + )); } Some(s) if s == "none" => { error!("'none' prompt in client id {} request", data.client_id); error = CoreAuthErrorResponseType::LoginRequired; } _ => { - return if let Some(session_cookie) = cookies.get("defguard_session") { + return if let Some(session_cookie) = cookies.get(SESSION_COOKIE_NAME) { if let Ok(Some(session)) = Session::find_by_id(&appstate.pool, session_cookie.value()).await { @@ -390,7 +390,7 @@ pub async fn authorization( if session.expired() { info!("Session {} for user id {} has expired, redirecting to login", session.id, session.user_id); let _result = session.delete(&appstate.pool).await; - login_redirect(&data, cookies).await + login_redirect(&data, private_cookies).await } else { // If session is present check if app is in user authorized apps. // If yes return auth code and state else redirect to consent form. @@ -406,28 +406,28 @@ pub async fn authorization( "OAuth client id {} authorized by user id {}, returning auth code", app.oauth2client_id, session.user_id ); - let key = Key::from( - appstate.config.secret_key.expose_secret().as_bytes(), - ); - let private_cookies = cookies.private(&key); - private_cookies.remove(Cookie::named(SIGN_IN_COOKIE_NAME)); + let private_cookies = private_cookies + .remove(Cookie::from(SIGN_IN_COOKIE_NAME)); let location = generate_auth_code_redirect( appstate, data, Some(session.user_id), ) .await?; - Ok(redirect_to(location)) + Ok(redirect_to(location, private_cookies)) } else { // If authorized app not found redirect to consent form info!( "OAuth client id {} not yet authorized by user id {}, redirecting to consent form", oauth2client.id.unwrap(), session.user_id ); - Ok(redirect_to(format!( - "/consent?{}", - serde_urlencoded::to_string(data).unwrap() - ))) + Ok(redirect_to( + format!( + "/consent?{}", + serde_urlencoded::to_string(data).unwrap() + ), + private_cookies, + )) } } } else { @@ -436,13 +436,13 @@ pub async fn authorization( "Session {} not found, redirecting to login page", session_cookie.value() ); - login_redirect(&data, cookies).await + login_redirect(&data, private_cookies).await } // If no session cookie provided redirect to login } else { info!("Session cookie not provided, redirecting to login page"); - login_redirect(&data, cookies).await + login_redirect(&data, private_cookies).await }; } } @@ -471,7 +471,7 @@ pub async fn authorization( }; }; - Ok(redirect_to(url)) + Ok(redirect_to(url, private_cookies)) } /// Login Authorization Endpoint redirect with authorization code @@ -479,8 +479,8 @@ pub async fn secure_authorization( session_info: SessionInfo, State(appstate): State, Query(data): Query, - cookies: Cookies, -) -> Result<(StatusCode, HeaderMap), WebError> { + private_cookies: PrivateCookieJar, +) -> Result<(StatusCode, HeaderMap, PrivateCookieJar), WebError> { let mut url = Url::parse(&data.redirect_uri).map_err(|_| WebError::Http(StatusCode::BAD_REQUEST))?; let error; @@ -516,18 +516,14 @@ pub async fn secure_authorization( "User {} allowed login with client {}", session_info.user.username, oauth2client.name ); - let key = Key::from(appstate.config.secret_key.expose_secret().as_bytes()); - let private_cookies = cookies.private(&key); - if let Some(cookie) = private_cookies.get(SIGN_IN_COOKIE_NAME) { - cookies.remove(cookie.clone()); - }; + let private_cookies = private_cookies.remove(SIGN_IN_COOKIE_NAME); let location = generate_auth_code_redirect(appstate, data, session_info.user.id).await?; info!( "Redirecting user {} to {location}", session_info.user.username ); - return Ok(redirect_to(location)); + return Ok(redirect_to(location, private_cookies)); } Err(err) => { info!( @@ -560,7 +556,7 @@ pub async fn secure_authorization( }; }; - Ok(redirect_to(url)) + Ok(redirect_to(url, private_cookies)) } /// https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest diff --git a/src/handlers/settings.rs b/src/handlers/settings.rs index b0ef02623..bcf633700 100644 --- a/src/handlers/settings.rs +++ b/src/handlers/settings.rs @@ -96,20 +96,17 @@ pub async fn patch_settings( pub async fn test_ldap_settings(_admin: AdminRole, State(appstate): State) -> ApiResult { debug!("Testing LDAP connection"); - match LDAPConnection::create(&appstate.pool).await { - Ok(_) => { - debug!("LDAP connected succesfully"); - Ok(ApiResponse { - json: json!({}), - status: StatusCode::OK, - }) - } - Err(_) => { - debug!("LDAP connection rejected"); - Ok(ApiResponse { - json: json!({}), - status: StatusCode::BAD_REQUEST, - }) - } + if LDAPConnection::create(&appstate.pool).await.is_ok() { + debug!("LDAP connected succesfully"); + Ok(ApiResponse { + json: json!({}), + status: StatusCode::OK, + }) + } else { + debug!("LDAP connection rejected"); + Ok(ApiResponse { + json: json!({}), + status: StatusCode::BAD_REQUEST, + }) } } diff --git a/src/handlers/ssh_authorized_keys.rs b/src/handlers/ssh_authorized_keys.rs index 0696bcd8c..9fecb8c57 100644 --- a/src/handlers/ssh_authorized_keys.rs +++ b/src/handlers/ssh_authorized_keys.rs @@ -62,20 +62,20 @@ pub async fn get_authorized_keys( debug!("User {username} is not a member of group {group_name}",); } } else { - debug!("Specified user does not exist") + debug!("Specified user does not exist"); } } None => { debug!("Fetching SSH keys for all users in group {group_name}"); // fetch all users in group - let users = group.fetch_all_members(&appstate.pool).await?; + let users = group.members(&appstate.pool).await?; for user in users { - add_user_keys_to_list(user) + add_user_keys_to_list(user); } } } } else { - debug!("Specified group does not exist") + debug!("Specified group does not exist"); } } None => { @@ -86,7 +86,7 @@ pub async fn get_authorized_keys( if let Some(user) = User::find_by_username(&appstate.pool, username).await? { add_user_keys_to_list(user); } else { - debug!("Specified user does not exist") + debug!("Specified user does not exist"); } } } diff --git a/src/handlers/user.rs b/src/handlers/user.rs index 0f2217826..25a51c939 100644 --- a/src/handlers/user.rs +++ b/src/handlers/user.rs @@ -5,24 +5,37 @@ use axum::{ use serde_json::json; use super::{ + mail::{send_mfa_configured_email, EMAIL_PASSOWRD_RESET_START_SUBJECT}, user_for_admin_or_self, AddUserData, ApiResponse, ApiResult, PasswordChange, PasswordChangeSelf, RecoveryCodes, StartEnrollmentRequest, Username, WalletChallenge, WalletChange, WalletSignature, }; use crate::{ appstate::AppState, - auth::{AdminRole, SessionInfo}, + auth::{SessionInfo, UserAdminRole}, db::{ + models::enrollment::{Token, PASSWORD_RESET_TOKEN_TYPE}, AppEvent, MFAMethod, OAuth2AuthorizedApp, Settings, User, UserDetails, UserInfo, Wallet, WebAuthn, WireguardNetwork, }, error::WebError, - handlers::mail::send_mfa_configured_email, ldap::utils::{ldap_add_user, ldap_change_password, ldap_delete_user, ldap_modify_user}, + mail::Mail, + templates, }; /// Verify the given username +/// +/// To enable LDAP sync usernames need to avoid reserved characters. +/// Username requirements: +/// - 3 - 64 characters long +/// - lowercase or uppercase latin alphabet letters (A-Z, a-z) +/// - digits (0-9) +/// - starts with non-special character +/// - special characters: . - _ +/// - no whitespaces fn check_username(username: &str) -> Result<(), WebError> { + // check length let length = username.len(); if !(3..64).contains(&length) { return Err(WebError::Serialization(format!( @@ -30,22 +43,25 @@ fn check_username(username: &str) -> Result<(), WebError> { ))); } + // check first character is a letter or digit if let Some(first_char) = username.chars().next() { - if first_char.is_ascii_digit() { + if !first_char.is_ascii_alphanumeric() { return Err(WebError::Serialization( - "Username must not start with a digit".into(), + "Username must not start with a special character".into(), )); } } + // check if username contains only valid characters if !username .chars() - .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit()) + .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '-' || c == '_') { return Err(WebError::Serialization( - "Username is not in lowercase".into(), + "Username contains invalid characters".into(), )); } + Ok(()) } @@ -74,7 +90,7 @@ pub(crate) fn check_password_strength(password: &str) -> Result<(), WebError> { Ok(()) } -pub async fn list_users(_admin: AdminRole, State(appstate): State) -> ApiResult { +pub async fn list_users(_role: UserAdminRole, State(appstate): State) -> ApiResult { let all_users = User::all(&appstate.pool).await?; let mut users: Vec = Vec::with_capacity(all_users.len()); for user in all_users { @@ -100,7 +116,7 @@ pub async fn get_user( } pub async fn add_user( - _admin: AdminRole, + _role: UserAdminRole, session: SessionInfo, State(appstate): State, Json(user_data): Json, @@ -110,7 +126,7 @@ pub async fn add_user( // check username if let Err(err) = check_username(&username) { - debug!("{}", err); + debug!("{err}"); return Ok(ApiResponse { json: json!({}), status: StatusCode::BAD_REQUEST, @@ -160,7 +176,7 @@ pub async fn add_user( // Trigger enrollment process manually pub async fn start_enrollment( - _admin: AdminRole, + _role: UserAdminRole, session: SessionInfo, State(appstate): State, Path(username): Path, @@ -178,12 +194,11 @@ pub async fn start_enrollment( )); } - let user = match User::find_by_username(&appstate.pool, &username).await? { - Some(user) => Ok(user), - None => Err(WebError::ObjectNotFound(format!( + let Some(user) = User::find_by_username(&appstate.pool, &username).await? else { + return Err(WebError::ObjectNotFound(format!( "user {username} not found" - ))), - }?; + ))); + }; let mut transaction = appstate.pool.begin().await?; @@ -191,7 +206,7 @@ pub async fn start_enrollment( .start_enrollment( &mut transaction, &session.user, - data.email.clone(), + data.email, appstate.config.enrollment_token_timeout.as_secs(), appstate.config.enrollment_url.clone(), data.send_enrollment_notification, @@ -249,12 +264,12 @@ pub async fn start_remote_desktop_configuration( } pub async fn username_available( - _admin: AdminRole, + _role: UserAdminRole, State(appstate): State, Json(data): Json, ) -> ApiResult { if let Err(err) = check_username(&data.username) { - debug!("{}", err); + debug!("{err}"); return Ok(ApiResponse { json: json!({}), status: StatusCode::BAD_REQUEST, @@ -279,7 +294,7 @@ pub async fn modify_user( debug!("User {} updating user {username}", session.user.username); let mut user = user_for_admin_or_self(&appstate.pool, &session, &username).await?; if let Err(err) = check_username(&user_info.username) { - debug!("{}", err); + debug!("Failed to check username {} {err}", user_info.username); return Ok(ApiResponse { json: json!({}), status: StatusCode::BAD_REQUEST, @@ -312,9 +327,7 @@ pub async fn modify_user( { let networks = WireguardNetwork::all(&mut *transaction).await?; for network in networks { - let gateway_events = network - .sync_allowed_devices(&mut transaction, &appstate.config.admin_groupname, None) - .await?; + let gateway_events = network.sync_allowed_devices(&mut transaction, None).await?; appstate.send_multiple_wireguard_events(gateway_events); } }; @@ -335,7 +348,7 @@ pub async fn modify_user( } pub async fn delete_user( - _admin: AdminRole, + _role: UserAdminRole, State(appstate): State, Path(username): Path, session: SessionInfo, @@ -396,7 +409,7 @@ pub async fn change_self_password( } pub async fn change_password( - _admin: AdminRole, + _role: UserAdminRole, session: SessionInfo, State(appstate): State, Path(username): Path, @@ -450,6 +463,89 @@ pub async fn change_password( } } +pub async fn reset_password( + _role: UserAdminRole, + session: SessionInfo, + State(appstate): State, + Path(username): Path, +) -> ApiResult { + debug!( + "Admin {} changing password for user {username}", + session.user.username, + ); + + if session.user.username == username { + debug!("Cannot change own password with this endpoint."); + return Ok(ApiResponse { + json: json!({}), + status: StatusCode::BAD_REQUEST, + }); + } + + let user = User::find_by_username(&appstate.pool, &username).await?; + + if let Some(user) = user { + let mut transaction = appstate.pool.begin().await?; + + Token::delete_unused_user_password_reset_tokens( + &mut transaction, + user.id.expect("Missing user ID"), + ) + .await?; + + let enrollment = Token::new( + user.id.expect("Missing user ID"), + Some(session.user.id.expect("Missing admin ID")), + Some(user.email.clone()), + appstate.config.password_reset_token_timeout.as_secs(), + Some(PASSWORD_RESET_TOKEN_TYPE.to_string()), + ); + enrollment.save(&mut transaction).await?; + + let mail = Mail { + to: user.email.clone(), + subject: EMAIL_PASSOWRD_RESET_START_SUBJECT.into(), + content: templates::email_password_reset_mail( + appstate.config.enrollment_url.clone(), + enrollment.id.clone().as_str(), + None, + None, + )?, + attachments: Vec::new(), + result_tx: None, + }; + + let to = mail.to.clone(); + + match &appstate.mail_tx.send(mail) { + Ok(()) => { + info!("Password reset email sent to {to}"); + Ok(()) + } + Err(err) => { + error!("Failed to send password reset email to {to} with error:\n{err}"); + Err(WebError::Serialization(format!( + "Could not send password reset email to user {username}" + ))) + } + }?; + + transaction.commit().await?; + + info!( + "Admin {} changed password for user {username}", + session.user.username + ); + Ok(ApiResponse::default()) + } else { + debug!("User not found"); + Ok(ApiResponse { + json: json!({}), + status: StatusCode::NOT_FOUND, + }) + } +} + /// Similar to [`models::WalletInfo`] but without `use_for_mfa`. #[derive(Deserialize)] pub struct WalletInfoShort { @@ -700,3 +796,31 @@ pub async fn delete_authorized_app( Err(WebError::ObjectNotFound("Authorized app not found".into())) } } + +#[cfg(test)] +mod test { + use super::*; + use claims::{assert_err, assert_ok}; + + #[test] + fn test_username_validation() { + // valid usernames + assert_ok!(check_username("zenek34")); + assert_ok!(check_username("zenekXXX__")); + assert_ok!(check_username("first.last")); + assert_ok!(check_username("First_Last")); + assert_ok!(check_username("32zenek")); + assert_ok!(check_username("32-zenek")); + + // invalid usernames + assert_err!(check_username("a")); + assert_err!(check_username("32")); + assert_err!(check_username("a4")); + assert_err!(check_username("__zenek")); + assert_err!(check_username("zenek?")); + assert_err!(check_username("MeMeMe!")); + assert_err!(check_username( + "averylongnameeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" + )); + } +} diff --git a/src/handlers/wireguard.rs b/src/handlers/wireguard.rs index 73e554535..489ba1fae 100644 --- a/src/handlers/wireguard.rs +++ b/src/handlers/wireguard.rs @@ -17,7 +17,7 @@ use uuid::Uuid; use super::{device_for_admin_or_self, user_for_admin_or_self, ApiResponse, ApiResult, WebError}; use crate::{ appstate::AppState, - auth::{AdminRole, Claims, ClaimsType, SessionInfo}, + auth::{Claims, ClaimsType, SessionInfo, VpnRole}, db::{ models::{ device::{ @@ -42,6 +42,9 @@ pub struct WireguardNetworkData { pub allowed_ips: Option, pub dns: Option, pub allowed_groups: Vec, + pub mfa_enabled: bool, + pub keepalive_interval: i32, + pub peer_disconnect_threshold: i32, } impl WireguardNetworkData { @@ -54,7 +57,7 @@ impl WireguardNetworkData { } } -// Used in process of importing network from wireguard config +// Used in process of importing network from WireGuard config #[derive(Serialize, Deserialize, Debug, Clone)] pub struct MappedDevices { pub devices: Vec, @@ -80,15 +83,15 @@ pub struct ImportedNetworkData { } pub async fn create_network( - _admin: AdminRole, + _role: VpnRole, State(appstate): State, session: SessionInfo, Json(data): Json, ) -> ApiResult { let network_name = data.name.clone(); debug!( - "User {} creating WireGuard network {}", - session.user.username, network_name + "User {} creating WireGuard network {network_name}", + session.user.username ); let allowed_ips = data.parse_allowed_ips(); let mut network = WireguardNetwork::new( @@ -98,6 +101,9 @@ pub async fn create_network( data.endpoint, data.dns, allowed_ips, + data.mfa_enabled, + data.keepalive_interval, + data.peer_disconnect_threshold, ) .map_err(|_| WebError::Serialization("Invalid network address".into()))?; @@ -108,9 +114,7 @@ pub async fn create_network( .await?; // generate IP addresses for existing devices - network - .add_all_allowed_devices(&mut transaction, &appstate.config.admin_groupname) - .await?; + network.add_all_allowed_devices(&mut transaction).await?; info!("Assigning IPs for existing devices in network {network}"); match &network.id { @@ -119,7 +123,7 @@ pub async fn create_network( .send_wireguard_event(GatewayEvent::NetworkCreated(*network_id, network.clone())); } None => { - error!("Network {} ID was not created during network creation, gateway event was not send!", &network.name); + error!("Network {} ID was not created during network creation, gateway event was not send!", network.name); return Ok(ApiResponse { json: json!({}), status: StatusCode::INTERNAL_SERVER_ERROR, @@ -130,8 +134,8 @@ pub async fn create_network( transaction.commit().await?; info!( - "User {} created WireGuard network {}", - session.user.username, network_name + "User {} created WireGuard network {network_name}", + session.user.username ); Ok(ApiResponse { json: json!(network), @@ -146,7 +150,7 @@ async fn find_network(id: i64, pool: &DbPool) -> Result, State(appstate): State, session: SessionInfo, @@ -167,13 +171,15 @@ pub async fn modify_network( network.port = data.port; network.dns = data.dns; network.address = data.address; + network.mfa_enabled = data.mfa_enabled; + network.keepalive_interval = data.keepalive_interval; + network.peer_disconnect_threshold = data.peer_disconnect_threshold; + network.save(&mut *transaction).await?; network .set_allowed_groups(&mut transaction, data.allowed_groups) .await?; - let _events = network - .sync_allowed_devices(&mut transaction, &appstate.config.admin_groupname, None) - .await?; + let _events = network.sync_allowed_devices(&mut transaction, None).await?; match &network.id { Some(network_id) => { @@ -206,7 +212,7 @@ pub async fn modify_network( } pub async fn delete_network( - _admin: AdminRole, + _role: VpnRole, Path(network_id): Path, State(appstate): State, session: SessionInfo, @@ -227,7 +233,7 @@ pub async fn delete_network( } pub async fn list_networks( - _admin: AdminRole, + _role: VpnRole, State(appstate): State, Extension(gateway_state): Extension>>, ) -> ApiResult { @@ -260,7 +266,7 @@ pub async fn list_networks( pub async fn network_details( Path(network_id): Path, - _admin: AdminRole, + _role: VpnRole, State(appstate): State, Extension(gateway_state): Extension>>, ) -> ApiResult { @@ -295,7 +301,7 @@ pub async fn network_details( pub async fn gateway_status( Path(network_id): Path, - _admin: AdminRole, + _role: VpnRole, Extension(gateway_state): Extension>>, ) -> ApiResult { debug!("Displaying gateway status for network {network_id}"); @@ -311,7 +317,7 @@ pub async fn gateway_status( pub async fn remove_gateway( Path((network_id, gateway_id)): Path<(i64, String)>, - _admin: AdminRole, + _role: VpnRole, Extension(gateway_state): Extension>>, ) -> ApiResult { info!("Removing gateway {gateway_id} in network {network_id}"); @@ -332,7 +338,7 @@ pub async fn remove_gateway( } pub async fn import_network( - _admin: AdminRole, + _role: VpnRole, State(appstate): State, Json(data): Json, ) -> ApiResult { @@ -367,22 +373,14 @@ pub async fn import_network( .map(|dev| dev.wireguard_ip) .collect(); let (devices, gateway_events) = network - .handle_imported_devices( - &mut transaction, - imported_devices, - &appstate.config.admin_groupname, - ) + .handle_imported_devices(&mut transaction, imported_devices) .await?; appstate.send_multiple_wireguard_events(gateway_events); // assign IPs for other existing devices info!("Assigning IPs in imported network for remaining existing devices"); let gateway_events = network - .sync_allowed_devices( - &mut transaction, - &appstate.config.admin_groupname, - Some(&reserved_ips), - ) + .sync_allowed_devices(&mut transaction, Some(&reserved_ips)) .await?; appstate.send_multiple_wireguard_events(gateway_events); @@ -396,7 +394,7 @@ pub async fn import_network( // This is used exclusively for the wizard to map imported devices to users. pub async fn add_user_devices( - _admin: AdminRole, + _role: VpnRole, session: SessionInfo, State(appstate): State, Path(network_id): Path, @@ -424,11 +422,7 @@ pub async fn add_user_devices( // wrap loop in transaction to abort if a device is invalid let mut transaction = appstate.pool.begin().await?; let events = network - .handle_mapped_devices( - &mut transaction, - mapped_devices, - &appstate.config.admin_groupname, - ) + .handle_mapped_devices(&mut transaction, mapped_devices) .await?; appstate.send_multiple_wireguard_events(events); transaction.commit().await?; @@ -490,9 +484,7 @@ pub async fn add_device( device: Device, } - let (network_info, configs) = device - .add_to_all_networks(&mut transaction, &appstate.config.admin_groupname) - .await?; + let (network_info, configs) = device.add_to_all_networks(&mut transaction).await?; let mut network_ips: Vec = Vec::new(); for network_info_item in network_info.clone() { @@ -519,7 +511,7 @@ pub async fn add_device( (None, None) } else { ( - Some(session.session.ip_address.clone()), + Some(session.session.ip_address.as_str()), session.session.device_info.clone(), ) }; @@ -530,9 +522,8 @@ pub async fn add_device( &user.email, &appstate.mail_tx, session_ip, - session_device_info, - ) - .await?; + session_device_info.as_deref(), + )?; info!( "User {} added device {device_name} for user {username}", @@ -590,6 +581,8 @@ pub async fn modify_device( let device_network_info = DeviceNetworkInfo { network_id, device_wireguard_ip: wireguard_network_device.wireguard_ip, + preshared_key: wireguard_network_device.preshared_key, + is_authorized: wireguard_network_device.is_authorized, }; network_info.push(device_network_info); } @@ -636,7 +629,7 @@ pub async fn delete_device( Ok(ApiResponse::default()) } -pub async fn list_devices(_admin: AdminRole, State(appstate): State) -> ApiResult { +pub async fn list_devices(_role: VpnRole, State(appstate): State) -> ApiResult { debug!("Listing devices"); let devices = Device::all(&appstate.pool).await?; info!("Listed devices"); @@ -683,14 +676,14 @@ pub async fn download_config( String::new() }; Err(WebError::ObjectNotFound(format!( - "No ip found for device: {}({device_id})", + "No IP address found for device: {}({device_id})", device.name ))) } } pub async fn create_network_token( - _admin: AdminRole, + _role: VpnRole, State(appstate): State, Path(network_id): Path, ) -> ApiResult { @@ -744,7 +737,7 @@ impl QueryFrom { } pub async fn user_stats( - _admin: AdminRole, + _role: VpnRole, State(appstate): State, Path(network_id): Path, Query(query_from): Query, @@ -769,7 +762,7 @@ pub async fn user_stats( } pub async fn network_stats( - _admin: AdminRole, + _role: VpnRole, State(appstate): State, Path(network_id): Path, Query(query_from): Query, diff --git a/src/headers.rs b/src/headers.rs index d9380509d..8dc6ace92 100644 --- a/src/headers.rs +++ b/src/headers.rs @@ -21,7 +21,7 @@ pub fn create_user_agent_parser() -> Arc { #[must_use] pub fn parse_user_agent<'a>( - user_parser: &'a Arc, + user_parser: &UserAgentParser, user_agent: &'a str, ) -> Option> { if user_agent.is_empty() { @@ -31,13 +31,11 @@ pub fn parse_user_agent<'a>( } } -pub fn get_device_info( - user_agent_parser: &Arc, - user_agent: &str, -) -> Option { +#[must_use] +pub fn get_device_info(user_agent_parser: &UserAgentParser, user_agent: &str) -> Option { let agent = parse_user_agent(user_agent_parser, user_agent); - agent.clone().map(|v| get_user_agent_device(&v)) + agent.map(|v| get_user_agent_device(&v)) } #[must_use] diff --git a/src/hex.rs b/src/hex.rs index 44fb14693..3f6cd5438 100644 --- a/src/hex.rs +++ b/src/hex.rs @@ -73,7 +73,7 @@ pub fn to_lower_hex(bytes: &[u8]) -> String { mod tests { use super::*; - #[std::prelude::v1::test] + #[test] fn test_hex_decode() { assert_eq!(hex_decode("deadf00d"), Ok(vec![0xde, 0xad, 0xf0, 0x0d])); assert_eq!(hex_decode("0Xdeadf00d"), Ok(vec![0xde, 0xad, 0xf0, 0x0d])); diff --git a/src/ldap/error.rs b/src/ldap/error.rs index 185fd33ec..ac790cd33 100644 --- a/src/ldap/error.rs +++ b/src/ldap/error.rs @@ -1,29 +1,28 @@ -use ldap3::LdapError; use std::{error::Error, fmt}; #[derive(Debug)] -pub enum OriLDAPError { +pub enum LdapError { Ldap(String), ObjectNotFound(String), MissingSettings, } -impl fmt::Display for OriLDAPError { +impl fmt::Display for LdapError { fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { match self { - OriLDAPError::Ldap(msg) => write!(f, "LDAP error: {msg}"), - OriLDAPError::ObjectNotFound(msg) => write!(f, "Object not found: {msg}"), - OriLDAPError::MissingSettings => { + LdapError::Ldap(msg) => write!(f, "LDAP error: {msg}"), + LdapError::ObjectNotFound(msg) => write!(f, "Object not found: {msg}"), + LdapError::MissingSettings => { write!(f, "LDAP settings are missing.") } } } } -impl Error for OriLDAPError {} +impl Error for LdapError {} -impl From for OriLDAPError { - fn from(error: LdapError) -> Self { +impl From for LdapError { + fn from(error: ldap3::LdapError) -> Self { Self::Ldap(error.to_string()) } } diff --git a/src/ldap/hash.rs b/src/ldap/hash.rs index 1fd5e624b..33cc69725 100644 --- a/src/ldap/hash.rs +++ b/src/ldap/hash.rs @@ -6,6 +6,8 @@ use sha1::{ Digest, Sha1, }; +use crate::hex::to_lower_hex; + /// Calculate salted SHA1 hash from given password in SSHA password storage scheme. #[must_use] pub fn salted_sha1_hash(password: &str) -> String { @@ -32,14 +34,14 @@ pub fn nthash(password: &str) -> String { .encode_utf16() .flat_map(|c| IntoIterator::into_iter(c.to_le_bytes())) .collect(); - format!("{:x}", Md4::digest(password_utf16_le)) + to_lower_hex(&Md4::digest(password_utf16_le)) } #[cfg(test)] mod tests { use super::*; - #[std::prelude::v1::test] + #[test] fn test_hash() { assert_eq!(nthash("password"), "8846f7eaee8fb117ad06bdd830b7586c"); assert_eq!( diff --git a/src/ldap/mod.rs b/src/ldap/mod.rs index 5f801629f..770a0a1a3 100644 --- a/src/ldap/mod.rs +++ b/src/ldap/mod.rs @@ -1,8 +1,11 @@ -use self::{error::OriLDAPError, model::Group}; -use crate::db::{DbPool, Settings, User}; -use ldap3::{drive, Ldap, LdapConnAsync, Mod, Scope, SearchEntry}; use std::collections::HashSet; +use ldap3::{drive, Ldap, LdapConnAsync, Mod, Scope, SearchEntry}; +use sqlx::PgExecutor; + +use self::error::LdapError; +use crate::db::{self, Settings, User}; + pub mod error; pub mod hash; pub mod model; @@ -21,7 +24,7 @@ macro_rules! hashset { }; } -#[derive(Debug, Clone)] +#[derive(Clone)] pub struct LDAPConfig { pub ldap_bind_username: String, pub ldap_group_search_base: String, @@ -36,54 +39,56 @@ pub struct LDAPConfig { impl LDAPConfig { /// Constructs user distinguished name. + #[must_use] pub fn user_dn(&self, username: &str) -> String { format!( - "{}={},{}", - &self.ldap_username_attr, username, &self.ldap_user_search_base, + "{}={username},{}", + self.ldap_username_attr, self.ldap_user_search_base, ) } /// Constructs group distinguished name. + #[must_use] pub fn group_dn(&self, groupname: &str) -> String { format!( - "{}={},{}", - &self.ldap_groupname_attr, groupname, &self.ldap_group_search_base, + "{}={groupname},{}", + self.ldap_groupname_attr, self.ldap_group_search_base, ) } } impl TryFrom for LDAPConfig { - type Error = OriLDAPError; + type Error = LdapError; - fn try_from(settings: Settings) -> Result { + fn try_from(settings: Settings) -> Result { Ok(Self { ldap_member_attr: settings .ldap_member_attr - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_group_member_attr: settings .ldap_group_member_attr - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_groupname_attr: settings .ldap_groupname_attr - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_username_attr: settings .ldap_username_attr - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_group_obj_class: settings .ldap_group_obj_class - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_user_obj_class: settings .ldap_user_obj_class - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_user_search_base: settings .ldap_user_search_base - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_bind_username: settings .ldap_bind_username - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, ldap_group_search_base: settings .ldap_group_search_base - .ok_or(OriLDAPError::MissingSettings)?, + .ok_or(LdapError::MissingSettings)?, }) } } @@ -94,18 +99,21 @@ pub struct LDAPConnection { } impl LDAPConnection { - pub async fn create(pool: &DbPool) -> Result { - let settings = Settings::get_settings(pool) + pub async fn create<'e, E>(executor: E) -> Result + where + E: PgExecutor<'e>, + { + let settings = Settings::get_settings(executor) .await - .map_err(|_| OriLDAPError::MissingSettings)?; + .map_err(|_| LdapError::MissingSettings)?; let config = LDAPConfig::try_from(settings.clone())?; - let url = settings.ldap_url.ok_or(OriLDAPError::MissingSettings)?; + let url = settings.ldap_url.ok_or(LdapError::MissingSettings)?; let password = settings .ldap_bind_password - .ok_or(OriLDAPError::MissingSettings)?; + .ok_or(LdapError::MissingSettings)?; let (conn, mut ldap) = LdapConnAsync::new(&url).await?; drive!(conn); - info!("Connected to LDAP: {}", &url); + info!("Connected to LDAP: {url}"); ldap.simple_bind(&config.ldap_bind_username, password.expose_secret()) .await? .success()?; @@ -113,7 +121,7 @@ impl LDAPConnection { } /// Searches LDAP for users. - async fn search_users(&mut self, filter: &str) -> Result, OriLDAPError> { + async fn search_users(&mut self, filter: &str) -> Result, LdapError> { let (rs, _res) = self .ldap .search( @@ -124,38 +132,34 @@ impl LDAPConnection { ) .await? .success()?; - info!("Performed LDAP user search with filter = {}", filter); + info!("Performed LDAP user search with filter = {filter}"); Ok(rs.into_iter().map(SearchEntry::construct).collect()) } /// Searches LDAP for groups. - async fn search_groups(&mut self, filter: &str) -> Result, OriLDAPError> { - let (rs, _res) = self - .ldap - .search( - &self.config.ldap_group_search_base, - Scope::Subtree, - filter, - vec![ - &self.config.ldap_username_attr, - &self.config.ldap_group_member_attr, - ], - ) - .await? - .success()?; - info!("Performed LDAP group search with filter = {}", filter); - Ok(rs.into_iter().map(SearchEntry::construct).collect()) - } + // async fn search_groups(&mut self, filter: &str) -> Result, LdapError> { + // let (rs, _res) = self + // .ldap + // .search( + // &self.config.ldap_group_search_base, + // Scope::Subtree, + // filter, + // vec![ + // &self.config.ldap_username_attr, + // &self.config.ldap_group_member_attr, + // ], + // ) + // .await? + // .success()?; + // info!("Performed LDAP group search with filter = {filter}"); + // Ok(rs.into_iter().map(SearchEntry::construct).collect()) + // } /// Creates LDAP object with specified distinguished name and attributes. - async fn add( - &mut self, - dn: &str, - attrs: Vec<(&str, HashSet<&str>)>, - ) -> Result<(), OriLDAPError> { - debug!("Adding object {}", dn); + async fn add(&mut self, dn: &str, attrs: Vec<(&str, HashSet<&str>)>) -> Result<(), LdapError> { + debug!("Adding object {dn}"); self.ldap.add(dn, attrs).await?.success()?; - info!("Added object {}", dn); + info!("Added object {dn}"); Ok(()) } @@ -165,23 +169,23 @@ impl LDAPConnection { old_dn: &str, new_dn: &str, mods: Vec>, - ) -> Result<(), OriLDAPError> { - debug!("Modifying object {}", old_dn); + ) -> Result<(), LdapError> { + debug!("Modifying LDAP object {old_dn}"); self.ldap.modify(old_dn, mods).await?; if old_dn != new_dn { if let Some((new_rdn, _rest)) = new_dn.split_once(',') { self.ldap.modifydn(old_dn, new_rdn, true, None).await?; } } - info!("Modified object {}", old_dn); + info!("Modified LDAP object {old_dn}"); Ok(()) } /// Deletes LDAP object with specified distinguished name. - pub async fn delete(&mut self, dn: &str) -> Result<(), OriLDAPError> { - debug!("Deleting object {}", dn); + pub async fn delete(&mut self, dn: &str) -> Result<(), LdapError> { + debug!("Deleting LDAP object {dn}"); self.ldap.delete(dn).await?; - info!("Deleted object {}", dn); + info!("Deleted LDAP object {dn}"); Ok(()) } @@ -189,8 +193,8 @@ impl LDAPConnection { pub async fn is_username_available(&mut self, username: &str) -> bool { let users = self .search_users(&format!( - "(&({}={})(|(objectClass={})))", - self.config.ldap_username_attr, username, self.config.ldap_user_obj_class + "(&({}={username})(|(objectClass={})))", + self.config.ldap_username_attr, self.config.ldap_user_obj_class )) .await; match users { @@ -201,26 +205,26 @@ impl LDAPConnection { /// Retrieves user with given username from LDAP. /// TODO: Password must agree with the password stored in LDAP. - pub async fn get_user(&mut self, username: &str, password: &str) -> Result { + pub async fn get_user(&mut self, username: &str, password: &str) -> Result { debug!("Performing LDAP user search: {username}"); let mut entries = self .search_users(&format!( - "(&({}={})(objectClass={}))", - self.config.ldap_username_attr, username, self.config.ldap_user_obj_class + "(&({}={username})(objectClass={}))", + self.config.ldap_username_attr, self.config.ldap_user_obj_class )) .await?; if let Some(entry) = entries.pop() { info!("Performed LDAP user search: {username}"); Ok(User::from_searchentry(&entry, username, password)) } else { - Err(OriLDAPError::ObjectNotFound(format!( + Err(LdapError::ObjectNotFound(format!( "User {username} not found", ))) } } /// Adds user to LDAP. - pub async fn add_user(&mut self, user: &User, password: &str) -> Result<(), OriLDAPError> { + pub async fn add_user(&mut self, user: &User, password: &str) -> Result<(), LdapError> { debug!("Adding LDAP user {}", user.username); let dn = self.config.user_dn(&user.username); let ssha_password = hash::salted_sha1_hash(password); @@ -232,7 +236,7 @@ impl LDAPConnection { } /// Modifies LDAP user. - pub async fn modify_user(&mut self, username: &str, user: &User) -> Result<(), OriLDAPError> { + pub async fn modify_user(&mut self, username: &str, user: &User) -> Result<(), LdapError> { debug!("Modifying user {username}"); let old_dn = self.config.user_dn(username); let new_dn = self.config.user_dn(&user.username); @@ -243,7 +247,7 @@ impl LDAPConnection { } /// Deletes user from LDAP. - pub async fn delete_user(&mut self, username: &str) -> Result<(), OriLDAPError> { + pub async fn delete_user(&mut self, username: &str) -> Result<(), LdapError> { debug!("Deleting user {username}"); let dn = self.config.user_dn(username); self.delete(&dn).await?; @@ -252,11 +256,7 @@ impl LDAPConnection { } /// Changes user password. - pub async fn set_password( - &mut self, - username: &str, - password: &str, - ) -> Result<(), OriLDAPError> { + pub async fn set_password(&mut self, username: &str, password: &str) -> Result<(), LdapError> { debug!("Setting password for user {username}"); let user_dn = self.config.user_dn(username); let ssha_password = hash::salted_sha1_hash(password); @@ -275,47 +275,66 @@ impl LDAPConnection { } /// Retrieves group with given groupname from LDAP. - pub async fn get_group(&mut self, groupname: &str) -> Result { - debug!("Performing LDAP group search: {groupname}"); - let mut enties = self - .search_groups(&format!( - "(&({}={})(objectClass={}))", - self.config.ldap_groupname_attr, groupname, self.config.ldap_group_obj_class - )) - .await?; - if let Some(entry) = enties.pop() { - info!("Performed LDAP user search: {groupname}"); - Ok(Group::from_searchentry(&entry, &self.config)) - } else { - Err(OriLDAPError::ObjectNotFound(format!( - "Group {groupname} not found" - ))) - } - } + // pub async fn get_group(&mut self, groupname: &str) -> Result { + // debug!("Performing LDAP group search: {groupname}"); + // let mut enties = self + // .search_groups(&format!( + // "(&({}={})(objectClass={}))", + // self.config.ldap_groupname_attr, groupname, self.config.ldap_group_obj_class + // )) + // .await?; + // if let Some(entry) = enties.pop() { + // info!("Performed LDAP user search: {groupname}"); + // Ok(Group::from_searchentry(&entry, &self.config)) + // } else { + // Err(LdapError::ObjectNotFound(format!( + // "Group {groupname} not found" + // ))) + // } + // } - /// Lists users satisfying specified criteria - pub async fn get_groups(&mut self) -> Result, OriLDAPError> { - debug!("Performing LDAP group search"); - let mut entries = self - .search_groups(&format!( - "(objectClass={})", - self.config.ldap_group_obj_class - )) - .await?; - let users = entries - .drain(..) - .map(|entry| Group::from_searchentry(&entry, &self.config)) - .collect(); - info!("Performed LDAP group search"); - Ok(users) + /// Modifies LDAP group. + pub async fn modify_group( + &mut self, + groupname: &str, + group: &db::Group, + ) -> Result<(), LdapError> { + debug!("Modifying LDAP group {groupname}"); + let old_dn = self.config.group_dn(groupname); + let new_dn = self.config.group_dn(&group.name); + self.modify( + &old_dn, + &new_dn, + vec![Mod::Replace("cn", hashset![group.name.as_str()])], + ) + .await?; + info!("Modified LDAP group {groupname}"); + Ok(()) } + /// Lists groups satisfying specified criteria + // pub async fn get_groups(&mut self) -> Result, LdapError> { + // debug!("Performing LDAP group search"); + // let mut entries = self + // .search_groups(&format!( + // "(objectClass={})", + // self.config.ldap_group_obj_class + // )) + // .await?; + // let users = entries + // .drain(..) + // .map(|entry| Group::from_searchentry(&entry, &self.config)) + // .collect(); + // info!("Performed LDAP group search"); + // Ok(users) + // } + /// Add user to a group. pub async fn add_user_to_group( &mut self, username: &str, groupname: &str, - ) -> Result<(), OriLDAPError> { + ) -> Result<(), LdapError> { let user_dn = self.config.user_dn(username); let group_dn = self.config.group_dn(groupname); self.modify( @@ -335,7 +354,7 @@ impl LDAPConnection { &mut self, username: &str, groupname: &str, - ) -> Result<(), OriLDAPError> { + ) -> Result<(), LdapError> { let user_dn = self.config.user_dn(username); let group_dn = self.config.group_dn(groupname); self.modify( diff --git a/src/ldap/model.rs b/src/ldap/model.rs index 40494da6d..e16d0ca90 100644 --- a/src/ldap/model.rs +++ b/src/ldap/model.rs @@ -1,8 +1,9 @@ -use crate::{db::User, hashset}; -use ldap3::{Mod, SearchEntry}; use std::collections::HashSet; +use ldap3::{Mod, SearchEntry}; + use super::LDAPConfig; +use crate::{db::User, hashset}; impl User { #[must_use] @@ -67,26 +68,27 @@ impl User { } } -pub struct Group { - pub name: String, - pub members: Vec, -} +// TODO: This struct is similar to `GroupInfo`, so maybe use one? +// pub(crate) struct Group { +// pub name: String, +// pub members: Vec, +// } -impl Group { - #[must_use] - pub fn from_searchentry(entry: &SearchEntry, config: &LDAPConfig) -> Self { - Self { - name: get_value_or_default(entry, &config.ldap_groupname_attr), - members: match entry.attrs.get(&config.ldap_group_member_attr) { - Some(members) => members - .iter() - .filter_map(|member| extract_dn_value(member)) - .collect(), - None => Vec::new(), - }, - } - } -} +// impl Group { +// #[must_use] +// pub(crate) fn from_searchentry(entry: &SearchEntry, config: &LDAPConfig) -> Self { +// Self { +// name: get_value_or_default(entry, &config.ldap_groupname_attr), +// members: match entry.attrs.get(&config.ldap_group_member_attr) { +// Some(members) => members +// .iter() +// .filter_map(|member| extract_dn_value(member)) +// .collect(), +// None => Vec::new(), +// }, +// } +// } +// } fn get_value_or_default(entry: &SearchEntry, key: &str) -> String { match entry.attrs.get(key) { diff --git a/src/ldap/utils.rs b/src/ldap/utils.rs index deebde04e..1fa8e07e5 100644 --- a/src/ldap/utils.rs +++ b/src/ldap/utils.rs @@ -1,19 +1,24 @@ -use super::{error::OriLDAPError, LDAPConnection}; -use crate::db::{DbPool, User}; +use sqlx::PgExecutor; + +use super::{error::LdapError, LDAPConnection}; +use crate::db::{DbPool, Group, User}; pub async fn user_from_ldap( pool: &DbPool, username: &str, password: &str, -) -> Result { +) -> Result { let mut ldap_connection = LDAPConnection::create(pool).await?; let mut user = ldap_connection.get_user(username, password).await?; let _result = user.save(pool).await; // FIXME: do not ignore errors Ok(user) } -pub async fn ldap_add_user(pool: &DbPool, user: &User, password: &str) -> Result<(), OriLDAPError> { - let mut ldap_connection = LDAPConnection::create(pool).await?; +pub async fn ldap_add_user<'e, E>(executor: E, user: &User, password: &str) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; match ldap_connection.add_user(user, password).await { Ok(()) => Ok(()), // this user might exist in LDAP, just try to set the password @@ -21,45 +26,72 @@ pub async fn ldap_add_user(pool: &DbPool, user: &User, password: &str) -> Result } } -pub async fn ldap_modify_user( - pool: &DbPool, +pub async fn ldap_modify_user<'e, E>( + executor: E, username: &str, user: &User, -) -> Result<(), OriLDAPError> { - let mut ldap_connection = LDAPConnection::create(pool).await?; +) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; ldap_connection.modify_user(username, user).await } -pub async fn ldap_delete_user(pool: &DbPool, username: &str) -> Result<(), OriLDAPError> { - let mut ldap_connection = LDAPConnection::create(pool).await?; +pub async fn ldap_delete_user<'e, E>(executor: E, username: &str) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; ldap_connection.delete_user(username).await } -pub async fn ldap_add_user_to_group( - pool: &DbPool, +pub async fn ldap_add_user_to_group<'e, E>( + executor: E, username: &str, groupname: &str, -) -> Result<(), OriLDAPError> { - let mut ldap_connection = LDAPConnection::create(pool).await?; +) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; ldap_connection.add_user_to_group(username, groupname).await } -pub async fn ldap_remove_user_from_group( - pool: &DbPool, +pub async fn ldap_remove_user_from_group<'e, E>( + executor: E, username: &str, groupname: &str, -) -> Result<(), OriLDAPError> { - let mut ldap_connection = LDAPConnection::create(pool).await?; +) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; ldap_connection .remove_user_from_group(username, groupname) .await } -pub async fn ldap_change_password( - pool: &DbPool, +pub async fn ldap_change_password<'e, E>( + executor: E, username: &str, password: &str, -) -> Result<(), OriLDAPError> { - let mut ldap_connection = LDAPConnection::create(pool).await?; +) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; ldap_connection.set_password(username, password).await } + +pub async fn ldap_modify_group<'e, E>( + executor: E, + groupname: &str, + group: &Group, +) -> Result<(), LdapError> +where + E: PgExecutor<'e>, +{ + let mut ldap_connection = LDAPConnection::create(executor).await?; + ldap_connection.modify_group(groupname, group).await +} diff --git a/src/lib.rs b/src/lib.rs index 6e39d69dd..51c902410 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -4,22 +4,24 @@ use std::{ sync::{Arc, Mutex}, }; -use crate::handlers::ssh_authorized_keys::get_authorized_keys; use anyhow::anyhow; use axum::{ handler::HandlerWithoutStateExt, http::{Request, StatusCode}, routing::{delete, get, patch, post, put}, - Extension, Router, Server, + serve, Extension, Router, }; -use handlers::settings::{get_settings_essentials, patch_settings, test_ldap_settings}; + +use ipnetwork::IpNetwork; use secrecy::ExposeSecret; -use tokio::sync::{ - broadcast::Sender, - mpsc::{UnboundedReceiver, UnboundedSender}, - OnceCell, +use tokio::{ + net::TcpListener, + sync::{ + broadcast::Sender, + mpsc::{UnboundedReceiver, UnboundedSender}, + OnceCell, + }, }; -use tower_cookies::CookieManagerLayer; use tower_http::{ services::{ServeDir, ServeFile}, trace::{DefaultOnResponse, TraceLayer}, @@ -31,7 +33,11 @@ use self::{ appstate::AppState, auth::{Claims, ClaimsType}, config::{DefGuardConfig, InitVpnLocationArgs}, - db::{init_db, AppEvent, DbPool, Device, GatewayEvent, User, WireguardNetwork}, + db::{ + init_db, + models::wireguard::{DEFAULT_DISCONNECT_THRESHOLD, DEFAULT_KEEPALIVE_INTERVAL}, + AppEvent, DbPool, Device, GatewayEvent, User, WireguardNetwork, + }, handlers::{ auth::{ authenticate, email_mfa_code, email_mfa_disable, email_mfa_enable, email_mfa_init, @@ -40,15 +46,22 @@ use self::{ webauthn_finish, webauthn_init, webauthn_start, }, forward_auth::forward_auth, - group::{add_group_member, get_group, list_groups, remove_group_member}, + group::{ + add_group_member, create_group, delete_group, get_group, list_groups, modify_group, + remove_group_member, + }, mail::{send_support_data, test_mail}, - settings::{get_settings, set_default_branding, update_settings}, + settings::{ + get_settings, get_settings_essentials, patch_settings, set_default_branding, + test_ldap_settings, update_settings, + }, + ssh_authorized_keys::get_authorized_keys, support::{configuration, logs}, user::{ add_user, change_password, change_self_password, delete_authorized_app, delete_security_key, delete_user, delete_wallet, get_user, list_users, me, modify_user, - set_wallet, start_enrollment, start_remote_desktop_configuration, update_wallet, - username_available, wallet_challenge, + reset_password, set_wallet, start_enrollment, start_remote_desktop_configuration, + update_wallet, username_available, wallet_challenge, }, webhooks::{ add_webhook, change_enabled, change_webhook, delete_webhook, get_webhook, list_webhooks, @@ -102,6 +115,7 @@ pub mod secret; pub mod support; pub mod templates; pub mod wg_config; +pub mod wireguard_peer_disconnect; pub mod wireguard_stats_purge; #[macro_use] @@ -180,6 +194,7 @@ pub fn build_webapp( // FIXME: username `change_password` is invalid .route("/user/change_password", put(change_self_password)) .route("/user/:username/password", put(change_password)) + .route("/user/:username/reset_password", post(reset_password)) .route("/user/:username/challenge", get(wallet_challenge)) .route("/user/:username/wallet", put(set_wallet)) .route("/user/:username/wallet/:address", put(update_wallet)) @@ -198,6 +213,9 @@ pub fn build_webapp( // group .route("/group", get(list_groups)) .route("/group/:name", get(get_group)) + .route("/group", post(create_group)) + .route("/group/:name", put(modify_group)) + .route("/group/:name", delete(delete_group)) .route("/group/:name", post(add_group_member)) .route("/group/:name/user/:username", delete(remove_group_member)) // mail @@ -303,7 +321,6 @@ pub fn build_webapp( user_agent_parser, failed_logins, )) - .layer(CookieManagerLayer::new()) .layer( TraceLayer::new_for_http() .make_span_with(|request: &Request<_>| { @@ -344,11 +361,13 @@ pub async fn run_web_server( ); info!("Started web services"); let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), config.http_port); - // TODO: map_err() and remove `hyper` as depenency from Cargo.toml - Server::bind(&addr) - .serve(webapp.into_make_service_with_connect_info::()) - .await - .map_err(|err| anyhow!("Web server can't be started {}", err)) + let listener = TcpListener::bind(&addr).await?; + serve( + listener, + webapp.into_make_service_with_connect_info::(), + ) + .await + .map_err(|err| anyhow!("Web server can't be started {err}")) } /// Automates test objects creation to easily setup development environment. @@ -387,14 +406,17 @@ pub async fn init_dev_env(config: &DefGuardConfig) { info!("Test network exists already, skipping creation..."); networks.into_iter().next().unwrap() } else { - info!("Creating test network "); + info!("Creating test network"); let mut network = WireguardNetwork::new( "TestNet".to_string(), - "10.1.1.1/24".parse().unwrap(), + IpNetwork::new(IpAddr::V4(Ipv4Addr::new(10, 1, 1, 1)), 24).unwrap(), 50051, "0.0.0.0".to_string(), None, - vec!["10.1.1.0/24".parse().unwrap()], + vec![IpNetwork::new(IpAddr::V4(Ipv4Addr::new(10, 1, 1, 0)), 24).unwrap()], + false, + DEFAULT_KEEPALIVE_INTERVAL, + DEFAULT_DISCONNECT_THRESHOLD, ) .expect("Could not create network"); network.pubkey = "zGMeVGm9HV9I4wSKF9AXmYnnAIhDySyqLMuKpcfIaQo=".to_string(); @@ -474,6 +496,9 @@ pub async fn init_vpn_location( args.endpoint.clone(), args.dns.clone(), args.allowed_ips.clone(), + false, + DEFAULT_KEEPALIVE_INTERVAL, + DEFAULT_DISCONNECT_THRESHOLD, )?; network.save(pool).await?; let network_id = network.get_id()?; diff --git a/src/random.rs b/src/random.rs index 624562d3e..3732db766 100644 --- a/src/random.rs +++ b/src/random.rs @@ -1,5 +1,6 @@ use rand::{distributions::Alphanumeric, thread_rng, Rng}; +/// Generate random alphanumeric string. #[must_use] pub(crate) fn gen_alphanumeric(n: usize) -> String { thread_rng() @@ -8,3 +9,9 @@ pub(crate) fn gen_alphanumeric(n: usize) -> String { .map(char::from) .collect() } + +/// Generate random 20-byte secret for TOTP. +#[must_use] +pub(crate) fn gen_totp_secret() -> Vec { + thread_rng().gen::<[u8; 20]>().to_vec() +} diff --git a/src/support.rs b/src/support.rs index 5655b7f54..19836167c 100644 --- a/src/support.rs +++ b/src/support.rs @@ -2,16 +2,15 @@ use std::{collections::HashMap, fmt::Display}; use serde::Serialize; use serde_json::{json, value::to_value, Value}; -use sqlx::{Pool, Postgres}; use crate::{ config::DefGuardConfig, - db::{models::device::WireguardNetworkDevice, Settings, User, WireguardNetwork}, + db::{models::device::WireguardNetworkDevice, DbPool, Settings, User, WireguardNetwork}, VERSION, }; /// Unwraps the result returning a JSON representation of value or error -fn unwrap_json(result: Result) -> Value { +fn unwrap_json(result: Result) -> Value { match result { Ok(value) => to_value(value).expect("conversion to JSON failed"), Err(err) => json!({"error": err.to_string()}), @@ -19,7 +18,7 @@ fn unwrap_json(result: Result) -> Value { } /// Dumps all data that could be used for debugging. -pub async fn dump_config(db: &Pool, config: &DefGuardConfig) -> Value { +pub async fn dump_config(db: &DbPool, config: &DefGuardConfig) -> Value { // App settings DB records let settings = match Settings::find_by_id(db, 1).await { Ok(Some(mut settings)) => { @@ -33,7 +32,7 @@ pub async fn dump_config(db: &Pool, config: &DefGuardConfig) -> Value let (networks, devices) = match WireguardNetwork::all(db).await { Ok(networks) => { // Devices for each network - let mut devices = HashMap::::default(); + let mut devices = HashMap::::new(); for network in &networks { let Some(network_id) = network.id else { continue; diff --git a/src/templates.rs b/src/templates.rs index 837db0aa9..52a712563 100644 --- a/src/templates.rs +++ b/src/templates.rs @@ -1,4 +1,4 @@ -use chrono::{Datelike, NaiveDateTime}; +use chrono::{Datelike, NaiveDateTime, Utc}; use reqwest::Url; use tera::{Context, Tera}; use thiserror::Error; @@ -27,6 +27,10 @@ static MAIL_NEW_DEVICE_OCID_LOGIN: &str = static MAIL_EMAIL_MFA_ACTIVATION: &str = include_str!("../templates/mail_email_mfa_activation.tera"); static MAIL_EMAIL_MFA_CODE: &str = include_str!("../templates/mail_email_mfa_code.tera"); +static MAIL_PASSWORD_RESET_START: &str = + include_str!("../templates/mail_password_reset_start.tera"); +static MAIL_PASSWORD_RESET_SUCCESS: &str = + include_str!("../templates/mail_password_reset_success.tera"); #[allow(dead_code)] static MAIL_DATE_FORMAT: &str = "%Y-%m-%dT%H:%M:00Z"; @@ -42,8 +46,8 @@ pub enum TemplateError { pub fn get_base_tera( external_context: Option, session: Option<&Session>, - ip_address: Option, - device_info: Option, + ip_address: Option<&str>, + device_info: Option<&str>, ) -> Result<(Tera, Context), TemplateError> { let mut tera = Tera::default(); let mut context = external_context.unwrap_or_default(); @@ -51,23 +55,23 @@ pub fn get_base_tera( tera.add_raw_template("macros.tera", MAIL_MACROS)?; // supply context required by base context.insert("application_version", &VERSION); - let now = chrono::Utc::now(); + let now = Utc::now(); let current_year = format!("{:04}", &now.year()); context.insert("current_year", ¤t_year); context.insert("date_now", &now.format("%A, %B %d, %Y at %r").to_string()); if let Some(current_session) = session { - let device_info = current_session.device_info.clone(); + let device_info = ¤t_session.device_info; context.insert("device_type", &device_info); context.insert("ip_address", ¤t_session.ip_address); } if let Some(ip) = ip_address { - context.insert("ip_address", &ip); + context.insert("ip_address", ip); } if let Some(device_info) = device_info { - context.insert("device_type", &device_info); + context.insert("device_type", device_info); } Ok((tera, context)) @@ -127,8 +131,8 @@ pub fn desktop_start_mail( // content is stored in markdown, so it's parsed into HTML pub fn enrollment_welcome_mail( content: &str, - ip_address: Option, - device_info: Option, + ip_address: Option<&str>, + device_info: Option<&str>, ) -> Result { let (mut tera, mut context) = get_base_tera(None, None, ip_address, device_info)?; tera.add_raw_template("mail_enrollment_welcome", MAIL_ENROLLMENT_WELCOME)?; @@ -147,8 +151,8 @@ pub fn enrollment_welcome_mail( pub fn enrollment_admin_notification( user: &User, admin: &User, - ip_address: String, - device_info: Option, + ip_address: &str, + device_info: Option<&str>, ) -> Result { let (mut tera, mut context) = get_base_tera(None, None, Some(ip_address), device_info)?; @@ -179,9 +183,9 @@ pub struct TemplateLocation { pub fn new_device_added_mail( device_name: &str, public_key: &str, - template_locations: &Vec, - ip_address: Option, - device_info: Option, + template_locations: &[TemplateLocation], + ip_address: Option<&str>, + device_info: Option<&str>, ) -> Result { let (mut tera, mut context) = get_base_tera(None, None, ip_address, device_info)?; context.insert("device_name", device_name); @@ -257,8 +261,8 @@ pub fn email_mfa_activation_mail(code: u32, session: &Session) -> Result Result { - let (mut tera, mut context) = get_base_tera(None, Some(session), None, None)?; +pub fn email_mfa_code_mail(code: u32, session: Option<&Session>) -> Result { + let (mut tera, mut context) = get_base_tera(None, session, None, None)?; // zero-pad code to make sure it's always 6 digits long context.insert("code", &format!("{code:0>6}")); tera.add_raw_template("mail_email_mfa_code", MAIL_EMAIL_MFA_CODE)?; @@ -266,6 +270,44 @@ pub fn email_mfa_code_mail(code: u32, session: &Session) -> Result, + device_info: Option<&str>, +) -> Result { + let (mut tera, mut context) = get_base_tera(None, None, ip_address, device_info)?; + + context.insert("enrollment_url", &service_url.to_string()); + context.insert( + "defguard_url", + &SERVER_CONFIG.get().expect("Server config not found").url, + ); + context.insert("token", password_reset_token); + + service_url.set_path("/password-reset"); + service_url + .query_pairs_mut() + .append_pair("token", password_reset_token); + + context.insert("link_url", &service_url.to_string()); + + tera.add_raw_template("mail_passowrd_reset_start", MAIL_PASSWORD_RESET_START)?; + + Ok(tera.render("mail_passowrd_reset_start", &context)?) +} + +pub fn email_password_reset_success_mail( + ip_address: Option<&str>, + device_info: Option<&str>, +) -> Result { + let (mut tera, context) = get_base_tera(None, None, ip_address, device_info)?; + + tera.add_raw_template("mail_passowrd_reset_success", MAIL_PASSWORD_RESET_SUCCESS)?; + + Ok(tera.render("mail_passowrd_reset_success", &context)?) +} + #[cfg(test)] mod test { use crate::config::DefGuardConfig; @@ -352,7 +394,7 @@ mod test { "Test device", "TestKey", &template_locations, - Some("1.1.1.1".to_string()), + Some("1.1.1.1"), None, )); } @@ -368,17 +410,17 @@ mod test { #[test] fn test_enrollment_admin_notification() { let test_user: User = User::new( - "test".into(), - "1234".into(), - "test_last".into(), - "test_first".into(), - "test@example.com".into(), + "test", + Some("1234"), + "test_last", + "test_first", + "test@example.com", Some("99999".into()), ); assert_ok!(enrollment_admin_notification( &test_user, &test_user, - "11.11.11.11".to_string(), + "11.11.11.11", None )); } diff --git a/src/wg_config.rs b/src/wg_config.rs index c1b480a3f..3a8307498 100644 --- a/src/wg_config.rs +++ b/src/wg_config.rs @@ -1,10 +1,16 @@ -use crate::db::{models::wireguard::WireguardNetworkError, Device, WireguardNetwork}; use base64::{prelude::BASE64_STANDARD, DecodeError, Engine}; use ipnetwork::{IpNetwork, IpNetworkError}; use std::{array::TryFromSliceError, net::IpAddr}; use thiserror::Error; use x25519_dalek::{PublicKey, StaticSecret}; +use crate::db::{ + models::wireguard::{ + WireguardNetworkError, DEFAULT_DISCONNECT_THRESHOLD, DEFAULT_KEEPALIVE_INTERVAL, + }, + Device, WireguardNetwork, +}; + #[derive(Debug, Clone, Serialize, Deserialize)] pub struct ImportedDevice { pub user_id: Option, @@ -29,7 +35,7 @@ pub enum WireguardConfigParseError { InvalidKey(String), #[error("Invalid port: {0}")] InvalidPort(String), - #[error("Wireguard network error")] + #[error("WireGuard network error")] NetworkError(#[from] WireguardNetworkError), } @@ -49,7 +55,7 @@ pub fn parse_wireguard_config( config: &str, ) -> Result<(WireguardNetwork, Vec), WireguardConfigParseError> { let config = ini::Ini::load_from_str(config)?; - // Parse WireguardNetwork + // Parse WireGuardNetwork let interface_section = config .section(Some("Interface")) .ok_or_else(|| WireguardConfigParseError::SectionNotFound("Interface".to_string()))?; @@ -81,6 +87,9 @@ pub fn parse_wireguard_config( String::new(), dns, vec![allowed_ips], + false, + DEFAULT_KEEPALIVE_INTERVAL, + DEFAULT_DISCONNECT_THRESHOLD, )?; network.pubkey = pubkey; network.prvkey = prvkey.to_string(); diff --git a/src/wireguard_peer_disconnect.rs b/src/wireguard_peer_disconnect.rs new file mode 100644 index 000000000..34d1757b6 --- /dev/null +++ b/src/wireguard_peer_disconnect.rs @@ -0,0 +1,128 @@ +//! This module implements a functionality of disconnecting inactive peers +//! in MFA-protected locations. +//! If a device does not disconnect explicitly and just becomes inactive +//! it should be removed from gateway configuration and marked as "not allowed", +//! which enforces an authentication requirement to connect again. + +use crate::db::{ + models::{ + device::{DeviceInfo, DeviceNetworkInfo, WireguardNetworkDevice}, + error::ModelError, + wireguard::WireguardNetworkError, + }, + DbPool, Device, GatewayEvent, WireguardNetwork, +}; +use sqlx::{query_as, Error as SqlxError}; +use std::time::Duration; +use thiserror::Error; +use tokio::{sync::broadcast::Sender, time::sleep}; + +// How long to sleep between loop iterations +const DISCONNECT_LOOP_SLEEP_SECONDS: u64 = 180; // 3 minutes + +#[derive(Debug, Error)] +pub enum PeerDisconnectError { + #[error(transparent)] + DbError(#[from] SqlxError), + #[error(transparent)] + ModelError(#[from] ModelError), + #[error(transparent)] + WireguardError(#[from] WireguardNetworkError), + #[error("Failed to send gateway event: {0}")] + EventError(String), +} + +/// Run periodic disconnect task +/// +/// Run with a specified frequency and disconnect all inactive peers in MFA-protected locations. +pub async fn run_periodic_peer_disconnect( + pool: DbPool, + wireguard_tx: Sender, +) -> Result<(), PeerDisconnectError> { + info!("Starting periodic disconnect of inactive devices in MFA-protected locations"); + loop { + debug!("Starting periodic inactive device disconnect"); + + // get all MFA-protected locations + let locations = query_as!( + WireguardNetwork, + "SELECT \ + id as \"id?\", name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, \ + connected_at, mfa_enabled, keepalive_interval, peer_disconnect_threshold \ + FROM wireguard_network WHERE mfa_enabled = true", + ) + .fetch_all(&pool) + .await?; + + // loop over all locations + for location in locations { + debug!("Fetching inactive devices for location {location}"); + let location_id = location.get_id()?; + let devices = query_as!( + Device, + "WITH stats AS ( \ + SELECT DISTINCT ON (device_id) device_id, endpoint, latest_handshake \ + FROM wireguard_peer_stats \ + WHERE network = $1 \ + ORDER BY device_id, collected_at DESC \ + ) \ + SELECT d.id as \"id?\", d.name, d.wireguard_pubkey, d.user_id, d.created \ + FROM device d \ + JOIN wireguard_network_device wnd ON wnd.device_id = d.id \ + LEFT JOIN stats on d.id = stats.device_id \ + WHERE wnd.wireguard_network_id = $1 AND wnd.is_authorized = true AND \ + (stats.latest_handshake IS NULL OR (NOW() - stats.latest_handshake) > $2 * interval '1 second')", + location_id, + location.peer_disconnect_threshold as f64 + ) + .fetch_all(&pool) + .await?; + + for device in devices { + debug!("Processing inactive device {device}"); + let device_id = device.get_id()?; + + // start transaction + let mut transaction = pool.begin().await?; + + // get network config for device + if let Some(mut device_network_config) = + WireguardNetworkDevice::find(&mut *transaction, device_id, location_id).await? + { + info!("Marking device {device} as not authorized to connect to location {location}"); + // change `is_authorized` value for device + device_network_config.is_authorized = false; + // clear `preshared_key` value + device_network_config.preshared_key = None; + device_network_config.update(&mut *transaction).await?; + + debug!("Sending `peer_delete` message to gateway"); + let device_info = DeviceInfo { + device, + network_info: vec![DeviceNetworkInfo { + network_id: location_id, + device_wireguard_ip: device_network_config.wireguard_ip, + preshared_key: device_network_config.preshared_key, + is_authorized: device_network_config.is_authorized, + }], + }; + let event = GatewayEvent::DeviceDeleted(device_info); + wireguard_tx.send(event).map_err(|err| { + error!("Error sending WireGuard event: {err}"); + PeerDisconnectError::EventError(err.to_string()) + })?; + } else { + error!("Network config for device {device} in location {location} not found. Skipping device..."); + continue; + } + + // commit transaction + transaction.commit().await?; + } + } + + // wait till next iteration + debug!("Sleeping until next iteration"); + sleep(Duration::from_secs(DISCONNECT_LOOP_SLEEP_SECONDS)).await; + } +} diff --git a/src/wireguard_stats_purge.rs b/src/wireguard_stats_purge.rs index 70e459607..2280a075f 100644 --- a/src/wireguard_stats_purge.rs +++ b/src/wireguard_stats_purge.rs @@ -1,7 +1,7 @@ use crate::db::{DbPool, WireguardPeerStats}; use chrono::{DateTime, Duration as ChronoDuration, NaiveDateTime, Utc}; use humantime::format_duration; -use sqlx::{query, query_scalar, Error as SqlxError}; +use sqlx::{query, query_scalar, Error as SqlxError, PgExecutor}; use std::time::Duration; use tokio::time::sleep; @@ -27,13 +27,12 @@ impl WireguardPeerStats { - ChronoDuration::from_std(stats_purge_threshold).expect("Failed to parse duration")) .naive_utc(); let result = query!( - r#"DELETE FROM wireguard_peer_stats - WHERE collected_at < $1 - AND (device_id, network, collected_at) NOT IN ( - SELECT device_id, network, MAX(collected_at) - FROM wireguard_peer_stats - GROUP BY device_id, network - )"#, + "DELETE FROM wireguard_peer_stats \ + WHERE collected_at < $1 \ + AND (device_id, network, collected_at) NOT IN ( \ + SELECT device_id, network, MAX(collected_at) \ + FROM wireguard_peer_stats \ + GROUP BY device_id, network)", threshold ) .execute(pool) @@ -53,7 +52,7 @@ impl WireguardPeerStats { // Check how much time has elapsed since last recorded stats purge pub async fn time_since_last_purge<'e, E>(executor: E) -> Result, SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { debug!("Checking time since last stats purge"); @@ -83,7 +82,7 @@ impl WireguardPeerStats { records_removed: i64, ) -> Result<(), SqlxError> where - E: sqlx::Executor<'e, Database = sqlx::Postgres>, + E: PgExecutor<'e>, { debug!("Recording successful stats purge in DB"); query!("INSERT INTO wireguard_stats_purge (started_at, finished_at, removal_threshold, records_removed) VALUES ($1, $2, $3, $4)", diff --git a/templates/base.tera b/templates/base.tera index 24db61235..b74d4fdd6 100644 --- a/templates/base.tera +++ b/templates/base.tera @@ -215,7 +215,7 @@ {% endblock %} -
+
diff --git a/templates/mail_password_reset_start.tera b/templates/mail_password_reset_start.tera new file mode 100644 index 000000000..7bd2fd595 --- /dev/null +++ b/templates/mail_password_reset_start.tera @@ -0,0 +1,39 @@ +{# Requires context +enrollment_url -> URL of the enrollment service +link_url -> URL of the enrollment service with the token query param included +defguard_url -> URL of defguard core Web UI +token -> enrollment token +#} +{% extends "base.tera" %} +{% import "macros.tera" as macros %} +{% block mail_content %} +{% set client_docs_url="https://defguard.gitbook.io/defguard/features/desktop-client" %} +{% set client_docs_link=macros::link(content=client_docs_url, href=client_docs_url) %} +{% set release_url="https://github.com/DefGuard/client/releases/latest" %} +{% set release_link=macros::link(content=release_url, href=release_url) %} +{% set section_content = [ +macros::paragraph(content="Password reset"), +macros::paragraph(content= "If you wish to reset your password, please copy & paste the following URL in your browser: "), +macros::link(content=link_url, href=link_url), +macros::paragraph(content="Or click the button below:"), +] %} +{{ macros::text_section(content_array=section_content)}} +

Reset password

+{% endblock %} diff --git a/templates/mail_password_reset_success.tera b/templates/mail_password_reset_success.tera new file mode 100644 index 000000000..4f087bd5d --- /dev/null +++ b/templates/mail_password_reset_success.tera @@ -0,0 +1,15 @@ +{# Requires context +enrollment_url -> URL of the enrollment service +link_url -> URL of the enrollment service with the token query param included +defguard_url -> URL of defguard core Web UI +token -> enrollment token +#} +{% extends "base.tera" %} +{% import "macros.tera" as macros %} +{% block mail_content %} +{% set section_content = [ +macros::paragraph(content="Password reset"), +macros::paragraph(content= "Your password has been successfully changed."), +] %} +{{ macros::text_section(content_array=section_content)}} +{% endblock %} diff --git a/tests/auth.rs b/tests/auth.rs index 111c58096..fe82f16ef 100644 --- a/tests/auth.rs +++ b/tests/auth.rs @@ -1,7 +1,8 @@ mod common; -use crate::common::ClientState; -use axum::http::StatusCode; +use std::{str::FromStr, time::SystemTime}; + +use chrono::NaiveDateTime; use claims::assert_err; use defguard::{ auth::TOTP_CODE_VALIDITY_PERIOD, @@ -12,16 +13,17 @@ use defguard::{ }; use ethers_core::types::transaction::eip712::{Eip712, TypedData}; use otpauth::TOTP; -use reqwest::header::USER_AGENT; +use reqwest::{header::USER_AGENT, StatusCode}; use secp256k1::{rand::rngs::OsRng, All, Message, Secp256k1, SecretKey}; use serde::Deserialize; use serde_json::json; use sqlx::query; -use std::{str::FromStr, time::SystemTime}; use webauthn_authenticator_rs::{prelude::Url, softpasskey::SoftPasskey, WebauthnAuthenticator}; use webauthn_rs::prelude::{CreationChallengeResponse, RequestChallengeResponse}; -use self::common::{client::TestClient, make_test_client}; +use self::common::{client::TestClient, make_test_client, ClientState, X_FORWARDED_FOR}; + +static SESSION_COOKIE_NAME: &str = "defguard_session"; #[derive(Deserialize)] pub struct RecoveryCodes { @@ -33,10 +35,10 @@ async fn make_client() -> TestClient { let mut wallet = Wallet::new_for_user( client_state.test_user.id.unwrap(), - "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e".into(), - "test".into(), + "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e", + "test", 5, - String::new(), + "", ); wallet.save(&client_state.pool).await.unwrap(); @@ -48,10 +50,10 @@ async fn make_client_with_db() -> (TestClient, DbPool) { let mut wallet = Wallet::new_for_user( client_state.test_user.id.unwrap(), - "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e".into(), - "test".into(), + "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e", + "test", 5, - String::new(), + "", ); wallet.save(&client_state.pool).await.unwrap(); @@ -63,26 +65,21 @@ async fn make_client_with_state() -> (TestClient, ClientState) { let mut wallet = Wallet::new_for_user( client_state.test_user.id.unwrap(), - "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e".into(), - "test".into(), + "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e", + "test", 5, - String::new(), + "", ); wallet.save(&client_state.pool).await.unwrap(); (client, client_state) } -async fn make_client_with_wallet(address: String) -> TestClient { +async fn make_client_with_wallet(address: &str) -> TestClient { let (client, client_state) = make_test_client().await; - let mut wallet = Wallet::new_for_user( - client_state.test_user.id.unwrap(), - address, - "test".into(), - 5, - String::new(), - ); + let mut wallet = + Wallet::new_for_user(client_state.test_user.id.unwrap(), address, "test", 5, ""); wallet.save(&client_state.pool).await.unwrap(); client @@ -92,14 +89,14 @@ async fn make_client_with_wallet(address: String) -> TestClient { async fn test_logout() { let mut client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); // store auth cookie for later use let auth_cookie = response .cookies() - .find(|c| c.name() == "defguard_session") + .find(|c| c.name() == SESSION_COOKIE_NAME) .unwrap(); let response = client.get("/api/v1/me").send().await; @@ -121,7 +118,7 @@ async fn test_logout() { async fn test_login_bruteforce() { let client = make_client().await; - let invalid_auth = Auth::new("hpotter".into(), "invalid".into()); + let invalid_auth = Auth::new("hpotter", "invalid"); // fail login 5 times in a row for i in 0..6 { @@ -138,7 +135,7 @@ async fn test_login_bruteforce() { async fn test_cannot_enable_mfa() { let client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -161,7 +158,7 @@ async fn test_totp() { let client = make_client().await; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -260,13 +257,14 @@ async fn test_totp() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); } +static EMAIL_CODE_REGEX: &str = r"(?\d{6})"; fn extract_email_code(content: &str) -> u32 { - let re = regex::Regex::new(r"(?\d{6})").unwrap(); + let re = regex::Regex::new(EMAIL_CODE_REGEX).unwrap(); let code = re.captures(content).unwrap().name("code").unwrap().as_str(); code.parse().unwrap() } @@ -282,7 +280,7 @@ async fn test_email_mfa() { assert_eq!(response.status(), StatusCode::UNAUTHORIZED); // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -408,7 +406,7 @@ async fn test_email_mfa() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); } @@ -421,7 +419,7 @@ async fn test_webauthn() { let origin = Url::parse("http://localhost:8000").unwrap(); // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -449,7 +447,7 @@ async fn test_webauthn() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::CREATED); @@ -478,7 +476,7 @@ async fn test_webauthn() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -498,7 +496,7 @@ async fn test_cannot_skip_otp_by_adding_yubikey() { let client = make_client().await; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -533,7 +531,7 @@ async fn test_cannot_skip_security_key_by_adding_yubikey() { let origin = Url::parse("http://localhost:8000").unwrap(); // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -557,7 +555,7 @@ async fn test_cannot_skip_security_key_by_adding_yubikey() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::CREATED); @@ -571,7 +569,7 @@ async fn test_mfa_method_is_updated_when_removing_last_webauthn_passkey() { let client = make_client().await; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -649,7 +647,7 @@ async fn test_mfa_method_is_updated_when_removing_last_webauthn_passkey() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::CREATED); @@ -706,13 +704,11 @@ This request will not trigger a blockchain transaction or cost any gas fees."; }}, "primaryType": "ProofOfOwnership", "message": {{ - "wallet": "{}", - "content": "{}", + "wallet": "{wallet_address}", + "content": "{challenge_message}", "nonce": {} }}}} "#, - wallet_address, - challenge_message, parsed_message.get("nonce").unwrap(), ) .chars() @@ -780,10 +776,10 @@ async fn test_web3() { let wallet_address = to_lower_hex(addr); // create client - let client = make_client_with_wallet(wallet_address.clone()).await; + let client = make_client_with_wallet(&wallet_address).await; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -806,7 +802,7 @@ async fn test_web3() { assert_eq!(response.status(), StatusCode::OK); // login with wallet - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::CREATED); wallet_login(&client, wallet_address, &secp, secret_key).await; @@ -816,7 +812,7 @@ async fn test_web3() { assert_eq!(response.status(), StatusCode::OK); // login again - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); } @@ -836,7 +832,7 @@ async fn test_re_adding_wallet() { let client = make_client().await; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -881,7 +877,7 @@ async fn test_re_adding_wallet() { assert_eq!(response.status(), StatusCode::OK); // login with wallet - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::CREATED); wallet_login(&client, wallet_address.clone(), &secp, secret_key).await; @@ -898,7 +894,7 @@ async fn test_re_adding_wallet() { assert_eq!(response.status(), StatusCode::OK); // login without MFA - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -941,7 +937,7 @@ async fn test_re_adding_wallet() { assert_eq!(response.status(), StatusCode::OK); // login with wallet - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::CREATED); wallet_login(&client, wallet_address.clone(), &secp, secret_key).await; @@ -954,7 +950,7 @@ async fn test_mfa_method_totp_enabled_mail() { let user_agent_header = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header) @@ -994,7 +990,7 @@ async fn test_new_device_login() { let user_agent_header_android = "Mozilla/5.0 (Linux; Android 7.0; SM-G930VC Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.83 Mobile Safari/537.36"; // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header_iphone) @@ -1018,7 +1014,7 @@ async fn test_new_device_login() { assert_eq!(response.status(), StatusCode::OK); // login using the same device - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header_iphone) @@ -1030,7 +1026,7 @@ async fn test_new_device_login() { assert_err!(mail_rx.try_recv()); // login using a different device - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header_android) @@ -1057,11 +1053,11 @@ async fn test_login_ip_headers() { let user_agent_header_iphone = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"; // Works with X-Forwarded-For header - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header_iphone) - .header("X-Forwarded-For", "10.0.0.20, 10.1.1.10") + .header(X_FORWARDED_FOR, "10.0.0.20, 10.1.1.10") .json(&auth) .send() .await; @@ -1075,3 +1071,35 @@ async fn test_login_ip_headers() { ); assert!(mail.content.contains("IP Address: 10.0.0.20")); } + +#[tokio::test] +async fn test_session_cookie() { + let (client, pool) = make_client_with_db().await; + + let auth = Auth::new("hpotter", "pass123"); + let response = client.post("/api/v1/auth").json(&auth).send().await; + assert_eq!(response.status(), StatusCode::OK); + + let auth_cookie = response + .cookies() + .find(|c| c.name() == SESSION_COOKIE_NAME) + .unwrap(); + + let session_id = auth_cookie.value(); + + // Forcibly expire the session + query!( + "UPDATE session SET expires = $1 WHERE id = $2", + NaiveDateTime::UNIX_EPOCH, + session_id + ) + .execute(&pool) + .await + .unwrap(); + + let response = client.get("/api/v1/me").send().await; + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); + + let auth_cookie = response.cookies().find(|c| c.name() == SESSION_COOKIE_NAME); + assert!(auth_cookie.is_none()); +} diff --git a/tests/common/client.rs b/tests/common/client.rs index 91b5809ea..af1374d09 100644 --- a/tests/common/client.rs +++ b/tests/common/client.rs @@ -1,22 +1,14 @@ -use axum::{ - http::{ - self, - header::{HeaderMap, HeaderName, HeaderValue}, - StatusCode, - }, - Router, Server, -}; +use std::{net::SocketAddr, sync::Arc}; + +use axum::{serve, Router}; use bytes::Bytes; use reqwest::{ cookie::{Cookie, Jar}, + header::{HeaderMap, HeaderName}, redirect::Policy, - Client, Url, -}; -use std::{ - convert::TryFrom, - net::{SocketAddr, TcpListener}, - sync::Arc, + Body, Client, StatusCode, Url, }; +use tokio::net::TcpListener; pub struct TestClient { client: Client, @@ -27,14 +19,17 @@ pub struct TestClient { #[allow(dead_code)] impl TestClient { #[must_use] - pub fn new(app: Router) -> Self { - let listener = TcpListener::bind("127.0.0.1:0").expect("Could not bind ephemeral socket"); + pub async fn new(app: Router) -> Self { + let listener = TcpListener::bind("127.0.0.1:0") + .await + .expect("Could not bind ephemeral socket"); let port = listener.local_addr().unwrap().port(); tokio::spawn(async move { - let server = Server::from_tcp(listener) - .unwrap() - .serve(app.into_make_service_with_connect_info::()); + let server = serve( + listener, + app.into_make_service_with_connect_info::(), + ); server.await.expect("server error"); }); @@ -126,7 +121,7 @@ impl RequestBuilder { } } - pub fn body(mut self, body: impl Into) -> Self { + pub fn body>(mut self, body: B) -> Self { self.builder = self.builder.body(body); self } @@ -144,13 +139,7 @@ impl RequestBuilder { self } - pub fn header(mut self, key: K, value: V) -> Self - where - HeaderName: TryFrom, - >::Error: Into, - HeaderValue: TryFrom, - >::Error: Into, - { + pub fn header(mut self, key: HeaderName, value: &str) -> Self { self.builder = self.builder.header(key, value); self } diff --git a/tests/common/mod.rs b/tests/common/mod.rs index e00fef02a..7fd848b31 100644 --- a/tests/common/mod.rs +++ b/tests/common/mod.rs @@ -2,7 +2,6 @@ pub(crate) mod client; use std::sync::{Arc, Mutex}; -use axum::http::StatusCode; use defguard::{ auth::failed_login::FailedLoginMap, build_webapp, @@ -13,16 +12,23 @@ use defguard::{ mail::Mail, SERVER_CONFIG, }; +use reqwest::{header::HeaderName, StatusCode}; use secrecy::ExposeSecret; use sqlx::{postgres::PgConnectOptions, query, types::Uuid}; -use tokio::sync::mpsc::UnboundedReceiver; use tokio::sync::{ broadcast::{self, Receiver}, - mpsc::unbounded_channel, + mpsc::{unbounded_channel, UnboundedReceiver}, }; use self::client::TestClient; +#[allow(dead_code)] +pub const X_FORWARDED_HOST: HeaderName = HeaderName::from_static("x-forwarded-host"); +#[allow(dead_code)] +pub const X_FORWARDED_FOR: HeaderName = HeaderName::from_static("x-forwarded-for"); +#[allow(dead_code)] +pub const X_FORWARDED_URI: HeaderName = HeaderName::from_static("x-forwarded-uri"); + pub async fn init_test_db() -> (DbPool, DefGuardConfig) { let config = DefGuardConfig::new_test_config(); let _ = SERVER_CONFIG.set(config.clone()); @@ -60,11 +66,11 @@ async fn initialize_users(pool: &DbPool, config: DefGuardConfig) { .unwrap(); let mut test_user = User::new( - "hpotter".into(), + "hpotter", Some("pass123"), - "Potter".into(), - "Harry".into(), - "h.potter@hogwart.edu.uk".into(), + "Potter", + "Harry", + "h.potter@hogwart.edu.uk", None, ); test_user.save(pool).await.unwrap(); @@ -150,7 +156,7 @@ pub async fn make_base_client(pool: DbPool, config: DefGuardConfig) -> (TestClie user_agent_parser, failed_logins, ); - (TestClient::new(webapp), client_state) + (TestClient::new(webapp).await, client_state) } #[allow(dead_code)] diff --git a/tests/enrollment.rs b/tests/enrollment.rs index 6594dafc5..1561e990b 100644 --- a/tests/enrollment.rs +++ b/tests/enrollment.rs @@ -1,10 +1,10 @@ mod common; -use axum::http::StatusCode; use defguard::{ - db::{models::enrollment::Enrollment, DbPool}, + db::{models::enrollment::Token, DbPool}, handlers::{AddUserData, Auth}, }; +use reqwest::StatusCode; use serde::Deserialize; use serde_json::json; @@ -19,7 +19,7 @@ async fn make_client() -> (TestClient, DbPool) { async fn test_initialize_enrollment() { let (client, pool) = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -36,7 +36,7 @@ async fn test_initialize_enrollment() { assert_eq!(response.status(), StatusCode::CREATED); // verify enrollment token was not created - let enrollments = Enrollment::fetch_all(&pool).await.unwrap(); + let enrollments = Token::fetch_all(&pool).await.unwrap(); assert_eq!(enrollments.len(), 0); // try to start enrollment @@ -64,7 +64,7 @@ async fn test_initialize_enrollment() { assert_eq!(response.status(), StatusCode::CREATED); // verify enrollment token was not created - let enrollments = Enrollment::fetch_all(&pool).await.unwrap(); + let enrollments = Token::fetch_all(&pool).await.unwrap(); assert_eq!(enrollments.len(), 0); // try to start enrollment @@ -77,10 +77,10 @@ async fn test_initialize_enrollment() { let response: StartEnrollmentResponse = response.json().await; // verify enrollment token was created - let enrollment = Enrollment::find_by_id(&pool, &response.enrollment_token) + let enrollment = Token::find_by_id(&pool, &response.enrollment_token) .await .unwrap(); assert_eq!(enrollment.user_id, 4); - assert_eq!(enrollment.admin_id, 1); + assert_eq!(enrollment.admin_id, Some(1)); assert_eq!(enrollment.used_at, None); } diff --git a/tests/forward_auth.rs b/tests/forward_auth.rs index 8df3f46c8..9b939b354 100644 --- a/tests/forward_auth.rs +++ b/tests/forward_auth.rs @@ -1,19 +1,19 @@ mod common; -use axum::http::StatusCode; use defguard::{db::Wallet, handlers::Auth, SERVER_CONFIG}; +use reqwest::StatusCode; -use self::common::{client::TestClient, make_test_client}; +use self::common::{client::TestClient, make_test_client, X_FORWARDED_HOST, X_FORWARDED_URI}; async fn make_client() -> TestClient { let (client, client_state) = make_test_client().await; let mut wallet = Wallet::new_for_user( client_state.test_user.id.unwrap(), - "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e".into(), - "test".into(), + "0x4aF8803CBAD86BA65ED347a3fbB3fb50e96eDD3e", + "test", 5, - String::new(), + "", ); wallet.save(&client_state.pool).await.unwrap(); @@ -27,8 +27,8 @@ async fn test_forward_auth() { // auth request from reverse proxy let response = client .get("/api/v1/forward_auth") - .header("x-forwarded-host", "app.example.com") - .header("x-forwarded-uri", "/test") + .header(X_FORWARDED_HOST, "app.example.com") + .header(X_FORWARDED_URI, "/test") .send() .await; assert_eq!(response.status(), StatusCode::TEMPORARY_REDIRECT); @@ -43,7 +43,7 @@ async fn test_forward_auth() { ); // login - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -57,8 +57,8 @@ async fn test_forward_auth() { client.set_cookie(&auth_cookie); let response = client .get("/api/v1/forward_auth") - .header("x-forwarded-host", "app.example.com") - .header("x-forwarded-uri", "/test") + .header(X_FORWARDED_HOST, "app.example.com") + .header(X_FORWARDED_URI, "/test") .send() .await; assert_eq!(response.status(), StatusCode::OK); diff --git a/tests/group.rs b/tests/group.rs new file mode 100644 index 000000000..dc62ff9d2 --- /dev/null +++ b/tests/group.rs @@ -0,0 +1,103 @@ +mod common; + +use defguard::handlers::{Auth, GroupInfo}; +use reqwest::StatusCode; + +use self::common::make_test_client; + +#[tokio::test] +async fn test_create_group() { + let (client, _) = make_test_client().await; + + // Authorize as an administrator. + let auth = Auth::new("admin", "pass123"); + let response = client.post("/api/v1/auth").json(&auth).send().await; + assert_eq!(response.status(), StatusCode::OK); + + // Create new group. + let data = GroupInfo::new("hogwards", Some(vec!["hpotter".into()])); + let response = client.post("/api/v1/group").json(&data).send().await; + assert_eq!(response.status(), StatusCode::CREATED); + + // Try to create the same group again. + let response = client.post("/api/v1/group").json(&data).send().await; + assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR); + + // Delete the group. + let response = client.delete("/api/v1/group/hogwards").send().await; + assert_eq!(response.status(), StatusCode::OK); + + // Try to delete again. + let response = client.delete("/api/v1/group/hogwards").send().await; + assert_eq!(response.status(), StatusCode::NOT_FOUND); +} + +#[tokio::test] +async fn test_modify_group() { + let (client, _) = make_test_client().await; + + // Authorize as an administrator. + let auth = Auth::new("admin", "pass123"); + let response = client.post("/api/v1/auth").json(&auth).send().await; + assert_eq!(response.status(), StatusCode::OK); + + // Create new group. + let data = GroupInfo::new("hogwards", Some(vec!["hpotter".into()])); + let response = client.post("/api/v1/group").json(&data).send().await; + assert_eq!(response.status(), StatusCode::CREATED); + + // Rename group. + let data = GroupInfo::new("gryffindor", None); + let response = client + .put("/api/v1/group/hogwards") + .json(&data) + .send() + .await; + assert_eq!(response.status(), StatusCode::OK); + + // Try to get the group by its old name. + let response = client.get("/api/v1/group/hogwards").send().await; + assert_eq!(response.status(), StatusCode::NOT_FOUND); + + // Get group info. + let response = client.get("/api/v1/group/gryffindor").send().await; + assert_eq!(response.status(), StatusCode::OK); + let group_info: GroupInfo = response.json().await; + assert_eq!(group_info.name, "gryffindor"); +} + +#[tokio::test] +async fn test_modify_group_members() { + let (client, _) = make_test_client().await; + + // Authorize as an administrator. + let auth = Auth::new("admin", "pass123"); + let response = client.post("/api/v1/auth").json(&auth).send().await; + assert_eq!(response.status(), StatusCode::OK); + + // Create new group. + let data = GroupInfo::new("hogwards", Some(vec!["hpotter".into()])); + let response = client.post("/api/v1/group").json(&data).send().await; + assert_eq!(response.status(), StatusCode::CREATED); + + // Get group info. + let response = client.get("/api/v1/group/hogwards").send().await; + assert_eq!(response.status(), StatusCode::OK); + let group_info: GroupInfo = response.json().await; + assert_eq!(group_info.members.unwrap(), vec!["hpotter".to_string()]); + + // Change group members. + let data = GroupInfo::new("hogwards", Some(Vec::new())); + let response = client + .put("/api/v1/group/hogwards") + .json(&data) + .send() + .await; + assert_eq!(response.status(), StatusCode::OK); + + // Get group info. + let response = client.get("/api/v1/group/hogwards").send().await; + assert_eq!(response.status(), StatusCode::OK); + let group_info: GroupInfo = response.json().await; + assert!(group_info.members.unwrap().is_empty()); +} diff --git a/tests/oauth.rs b/tests/oauth.rs index ef0fcf615..aebe081d1 100644 --- a/tests/oauth.rs +++ b/tests/oauth.rs @@ -2,7 +2,6 @@ mod common; use std::borrow::Cow; -use axum::http::StatusCode; use defguard::{ db::{ models::{ @@ -13,7 +12,7 @@ use defguard::{ }, handlers::Auth, }; -use reqwest::Url; +use reqwest::{header::CONTENT_TYPE, StatusCode, Url}; use serde_json::json; use self::common::{client::TestClient, make_test_client}; @@ -27,7 +26,7 @@ async fn make_client() -> (TestClient, DbPool) { async fn test_authorize() { let (client, pool) = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -166,7 +165,7 @@ async fn test_openid_app_management_access() { let (client, _) = make_client().await; // login as admin - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -268,7 +267,7 @@ async fn test_openid_app_management_access() { let test_app = &apps[0]; // // login as standard user - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -413,7 +412,7 @@ async fn test_token_client_credentials() { let response = client .post("/api/v1/oauth/token") - .header("Content-Type", "application/x-www-form-urlencoded") + .header(CONTENT_TYPE, "application/x-www-form-urlencoded") .body("client_id=WrongClient&client_secret=WrongSecret&grant_type=code") .send() .await; diff --git a/tests/openid.rs b/tests/openid.rs index 818a041bf..260576622 100644 --- a/tests/openid.rs +++ b/tests/openid.rs @@ -1,4 +1,6 @@ -use axum::http::{header::ToStrError, StatusCode}; +use std::str::FromStr; + +use axum::http::header::ToStrError; use claims::assert_err; use defguard::{ config::DefGuardConfig, @@ -17,7 +19,10 @@ use openidconnect::{ EmptyAdditionalClaims, HttpRequest, HttpResponse, IssuerUrl, Nonce, OAuth2TokenResponse, PkceCodeChallenge, RedirectUrl, Scope, UserInfoClaims, }; -use reqwest::header::USER_AGENT; +use reqwest::{ + header::{HeaderName, AUTHORIZATION, CONTENT_TYPE, USER_AGENT}, + StatusCode, +}; use rsa::RsaPrivateKey; use serde::Deserialize; @@ -44,7 +49,7 @@ pub struct AuthenticationResponse<'r> { async fn test_openid_client() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -102,7 +107,7 @@ async fn test_openid_client() { #[tokio::test] async fn test_openid_flow() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); let openid_client = NewOpenIDClient { @@ -200,7 +205,7 @@ async fn test_openid_flow() { // exchange wrong code for token should fail let response = client .post("/api/v1/oauth/token") - .header("Content-Type", "application/x-www-form-urlencoded") + .header(CONTENT_TYPE, "application/x-www-form-urlencoded") .body(format!( "grant_type=authorization_code&\ code=ncuoew2323&\ @@ -216,7 +221,7 @@ async fn test_openid_flow() { // exchange correct code for token let response = client .post("/api/v1/oauth/token") - .header("Content-Type", "application/x-www-form-urlencoded") + .header(CONTENT_TYPE, "application/x-www-form-urlencoded") .body(format!( "grant_type=authorization_code&\ code={}&\ @@ -232,34 +237,29 @@ async fn test_openid_flow() { // make sure access token cannot be used to manage defguard server itself client.post("/api/v1/auth/logout").send().await; let token_response: CoreTokenResponse = response.json().await; + let bearer = format!("Bearer {}", token_response.access_token().secret()); let response = client .get("/api/v1/network") - .header( - "Authorization", - format!("Bearer {}", token_response.access_token().secret()), - ) + .header(AUTHORIZATION, &bearer) .send() .await; assert_eq!(response.status(), StatusCode::UNAUTHORIZED); let response = client .get("/api/v1/user") - .header( - "Authorization", - format!("Bearer {}", token_response.access_token().secret()), - ) + .header(AUTHORIZATION, &bearer) .send() .await; assert_eq!(response.status(), StatusCode::UNAUTHORIZED); // log back in - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); // check code cannot be reused let response = client .post("/api/v1/oauth/token") - .header("Content-Type", "application/x-www-form-urlencoded") + .header(CONTENT_TYPE, "application/x-www-form-urlencoded") .body(format!( "grant_type=authorization_code&\ code={}&\ @@ -383,7 +383,10 @@ async fn http_client( _ => unimplemented!(), }; for (key, value) in &request.headers { - test_request = test_request.header(key.as_str(), value.to_str()?); + test_request = test_request.header( + HeaderName::from_str(key.as_str()).unwrap(), + value.to_str().unwrap(), + ); } let response = test_request.body(request.body).send().await; @@ -411,7 +414,7 @@ async fn test_openid_authorization_code() { .unwrap(); // create OAuth2 client - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); let oauth2client = NewOpenIDClient { @@ -516,7 +519,7 @@ async fn test_openid_authorization_code_with_pkce() { .unwrap(); // create OAuth2 client/application - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); let oauth2client = NewOpenIDClient { @@ -619,7 +622,7 @@ async fn test_openid_flow_new_login_mail() { let mut mail_rx = state.mail_rx; let user_agent_header = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header) diff --git a/tests/settings.rs b/tests/settings.rs index c3e22d6f2..9d50e95c0 100644 --- a/tests/settings.rs +++ b/tests/settings.rs @@ -1,11 +1,11 @@ mod common; -use axum::http::StatusCode; use common::ClientState; use defguard::{ db::models::settings::{Settings, SettingsPatch}, handlers::Auth, }; +use reqwest::StatusCode; use self::common::{client::TestClient, make_test_client}; @@ -17,7 +17,7 @@ async fn make_client() -> (TestClient, ClientState) { #[tokio::test] async fn test_settings() { let (client, _client_state) = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); // get settings diff --git a/tests/user.rs b/tests/user.rs index 5d0d3e96b..07238c70f 100644 --- a/tests/user.rs +++ b/tests/user.rs @@ -1,6 +1,5 @@ mod common; -use axum::http::StatusCode; use defguard::{ db::{ models::{oauth2client::OAuth2Client, wallet::keccak256, NewOpenIDClient}, @@ -10,7 +9,7 @@ use defguard::{ hex::to_lower_hex, }; use ethers_core::types::transaction::eip712::{Eip712, TypedData}; -use reqwest::header::USER_AGENT; +use reqwest::{header::USER_AGENT, StatusCode}; use secp256k1::{rand::rngs::OsRng, Message, Secp256k1}; use serde_json::{json, Value}; use tokio_stream::{self as stream, StreamExt}; @@ -26,15 +25,15 @@ async fn make_client() -> TestClient { async fn test_authenticate() { let client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); - let auth = Auth::new("hpotter".into(), "-wrong-".into()); + let auth = Auth::new("hpotter", "-wrong-"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::UNAUTHORIZED); - let auth = Auth::new("adumbledore".into(), "pass123".into()); + let auth = Auth::new("adumbledore", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::UNAUTHORIZED); } @@ -43,7 +42,7 @@ async fn test_authenticate() { async fn test_me() { let client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -58,7 +57,7 @@ async fn test_me() { async fn test_change_self_password() { let client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -107,7 +106,7 @@ async fn test_change_self_password() { let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::UNAUTHORIZED); - let new_auth = Auth::new("hpotter".into(), new_password.into()); + let new_auth = Auth::new("hpotter", new_password); let response = client.post("/api/v1/auth").json(&new_auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -117,7 +116,7 @@ async fn test_change_self_password() { async fn test_change_password() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -147,7 +146,7 @@ async fn test_change_password() { assert_eq!(response.status(), StatusCode::OK); - let auth = Auth::new("hpotter".into(), new_password.to_string()); + let auth = Auth::new("hpotter", new_password); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -168,7 +167,7 @@ async fn test_list_users() { assert_eq!(response.status(), StatusCode::UNAUTHORIZED); // normal user cannot list users - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -176,7 +175,7 @@ async fn test_list_users() { assert_eq!(response.status(), StatusCode::FORBIDDEN); // admin can list users - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -191,7 +190,7 @@ async fn test_get_user() { let response = client.get("/api/v1/user/hpotter").send().await; assert_eq!(response.status(), StatusCode::UNAUTHORIZED); - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -205,7 +204,7 @@ async fn test_username_available() { let client = make_client().await; // standard user cannot check username availability - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -220,12 +219,12 @@ async fn test_username_available() { assert_eq!(response.status(), StatusCode::FORBIDDEN); // log in as admin - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); let avail = Username { - username: "CrashTestDummy".into(), + username: "_CrashTestDummy".into(), }; let response = client .post("/api/v1/user/available") @@ -235,7 +234,7 @@ async fn test_username_available() { assert_eq!(response.status(), StatusCode::BAD_REQUEST); let avail = Username { - username: "crashtestdummy".into(), + username: "crashtestdummy42".into(), }; let response = client .post("/api/v1/user/available") @@ -259,7 +258,7 @@ async fn test_username_available() { async fn test_crud_user() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -297,7 +296,7 @@ async fn test_crud_user() { async fn test_admin_group() { let client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -314,7 +313,7 @@ async fn test_admin_group() { async fn test_wallet() { let client = make_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -428,12 +427,12 @@ This request will not trigger a blockchain transaction or cost any gas fees."; async fn test_check_username() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); - let invalid_usernames = ["ADumbledore", "1user"]; - let valid_usernames = ["user1", "use2r3", "notwrong"]; + let invalid_usernames = ["ADumble dore", ".1user"]; + let valid_usernames = ["user1", "use2r3", "not_wrong"]; for username in invalid_usernames { let new_user = AddUserData { @@ -467,7 +466,7 @@ async fn test_check_password_strength() { let client = make_client().await; // auth session with admin - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -514,7 +513,7 @@ async fn test_check_password_strength() { #[tokio::test] async fn test_user_unregister_authorized_app() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); let openid_client = NewOpenIDClient { @@ -570,6 +569,9 @@ fn make_network() -> Value { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": [], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 }) } @@ -580,7 +582,7 @@ async fn test_user_add_device() { let user_agent_header = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"; // log in as admin - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header) @@ -650,7 +652,7 @@ async fn test_user_add_device() { .contains("Device type: iPhone, OS: iOS 17.1, Mobile Safari")); // log in as normal user - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client .post("/api/v1/auth") .header(USER_AGENT, user_agent_header) diff --git a/tests/webhook.rs b/tests/webhook.rs index bb56756d6..fe986d582 100644 --- a/tests/webhook.rs +++ b/tests/webhook.rs @@ -1,7 +1,7 @@ mod common; -use axum::http::StatusCode; use defguard::{db::WebHook, handlers::Auth}; +use reqwest::StatusCode; use self::common::{client::TestClient, make_test_client}; @@ -14,7 +14,7 @@ async fn make_client() -> TestClient { async fn test_webhooks() { let client = make_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); diff --git a/tests/wireguard.rs b/tests/wireguard.rs index 60df675e8..c999da6cd 100644 --- a/tests/wireguard.rs +++ b/tests/wireguard.rs @@ -1,11 +1,17 @@ mod common; -use axum::http::StatusCode; use defguard::{ - db::{models::device::WireguardNetworkDevice, Device, GatewayEvent, WireguardNetwork}, + db::{ + models::{ + device::WireguardNetworkDevice, + wireguard::{DEFAULT_DISCONNECT_THRESHOLD, DEFAULT_KEEPALIVE_INTERVAL}, + }, + Device, GatewayEvent, WireguardNetwork, + }, handlers::{wireguard::WireguardNetworkData, Auth}, }; use matches::assert_matches; +use reqwest::StatusCode; use serde_json::{json, Value}; use self::common::make_test_client; @@ -19,6 +25,9 @@ fn make_network() -> Value { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": [], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 }) } @@ -28,7 +37,7 @@ async fn test_network() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -53,6 +62,9 @@ async fn test_network() { allowed_ips: Some("10.1.1.0/24".into()), dns: None, allowed_groups: vec![], + mfa_enabled: false, + keepalive_interval: DEFAULT_KEEPALIVE_INTERVAL, + peer_disconnect_threshold: DEFAULT_DISCONNECT_THRESHOLD, }; let response = client .put(format!("/api/v1/network/{}", network.id.unwrap())) @@ -96,7 +108,7 @@ async fn test_device() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -261,7 +273,7 @@ async fn test_device() { async fn test_device_permissions() { let (client, _) = make_test_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -323,7 +335,7 @@ async fn test_device_permissions() { assert_eq!(response.status(), StatusCode::CREATED); // normal user cannot add devices for other users or import multiple devices - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -385,7 +397,7 @@ async fn test_device_permissions() { assert_eq!(user_devices.len(), 3); // admin can list devices of other users - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -406,7 +418,7 @@ async fn test_device_pubkey() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); diff --git a/tests/wireguard_network_allowed_groups.rs b/tests/wireguard_network_allowed_groups.rs index 717c7ed23..0822163a6 100644 --- a/tests/wireguard_network_allowed_groups.rs +++ b/tests/wireguard_network_allowed_groups.rs @@ -1,12 +1,12 @@ mod common; -use axum::http::StatusCode; use claims::assert_err; use defguard::{ db::{DbPool, Device, GatewayEvent, Group, User, WireguardNetwork}, handlers::{wireguard::ImportedNetworkData, Auth}, }; use matches::assert_matches; +use reqwest::StatusCode; use serde_json::json; use self::common::{fetch_user_details, make_test_client}; @@ -53,11 +53,11 @@ async fn setup_test_users(pool: &DbPool) -> (Vec, Vec) { // standard user in other, non-allowed group let mut other_user = User::new( - "ssnape".into(), + "ssnape", Some("pass123"), - "Snape".into(), - "Severus".into(), - "s.snape@hogwart.edu.uk".into(), + "Snape", + "Severus", + "s.snape@hogwart.edu.uk", None, ); other_user.save(pool).await.unwrap(); @@ -76,11 +76,11 @@ async fn setup_test_users(pool: &DbPool) -> (Vec, Vec) { // standard user in no groups let mut non_group_user = User::new( - "dobby".into(), + "dobby", Some("pass123"), - "Elf".into(), - "Dobby".into(), - "dobby@hogwart.edu.uk".into(), + "Elf", + "Dobby", + "dobby@hogwart.edu.uk", None, ); non_group_user.save(pool).await.unwrap(); @@ -103,7 +103,7 @@ async fn test_create_new_network() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -118,6 +118,9 @@ async fn test_create_new_network() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": ["allowed group"], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; @@ -142,7 +145,7 @@ async fn test_modify_network() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -157,6 +160,9 @@ async fn test_modify_network() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": [], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; @@ -185,6 +191,9 @@ async fn test_modify_network() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": ["allowed group"], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; @@ -207,6 +216,9 @@ async fn test_modify_network() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": ["allowed group", "not allowed group"], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; @@ -230,6 +242,9 @@ async fn test_modify_network() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": ["not allowed group"], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; @@ -252,6 +267,9 @@ async fn test_modify_network() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": [], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; @@ -276,7 +294,7 @@ async fn test_import_network_existing_devices() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -364,7 +382,7 @@ async fn test_import_mapping_devices() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -472,7 +490,7 @@ async fn test_modify_user() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -487,6 +505,9 @@ async fn test_modify_user() { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": ["allowed group"], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 })) .send() .await; diff --git a/tests/wireguard_network_import.rs b/tests/wireguard_network_import.rs index 5cdbee0a5..1ac5c5f3a 100644 --- a/tests/wireguard_network_import.rs +++ b/tests/wireguard_network_import.rs @@ -1,11 +1,17 @@ mod common; -use axum::http::StatusCode; use defguard::{ - db::{models::device::UserDevice, Device, GatewayEvent, WireguardNetwork}, + db::{ + models::{ + device::UserDevice, + wireguard::{DEFAULT_DISCONNECT_THRESHOLD, DEFAULT_KEEPALIVE_INTERVAL}, + }, + Device, GatewayEvent, WireguardNetwork, + }, handlers::{wireguard::ImportedNetworkData, Auth}, }; use matches::assert_matches; +use reqwest::StatusCode; use serde_json::json; use tokio::sync::broadcast::error::TryRecvError; @@ -46,6 +52,9 @@ async fn test_config_import() { String::new(), None, vec![], + false, + DEFAULT_KEEPALIVE_INTERVAL, + DEFAULT_DISCONNECT_THRESHOLD, ) .unwrap(); initial_network.save(&pool).await.unwrap(); @@ -60,7 +69,7 @@ async fn test_config_import() { ); device_1.save(&mut *transaction).await.unwrap(); device_1 - .add_to_all_networks(&mut transaction, &client_state.config.admin_groupname) + .add_to_all_networks(&mut transaction) .await .unwrap(); @@ -71,7 +80,7 @@ async fn test_config_import() { ); device_2.save(&mut *transaction).await.unwrap(); device_2 - .add_to_all_networks(&mut transaction, &client_state.config.admin_groupname) + .add_to_all_networks(&mut transaction) .await .unwrap(); @@ -79,7 +88,7 @@ async fn test_config_import() { let mut wg_rx = client_state.wireguard_rx; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -228,7 +237,7 @@ async fn test_config_import_missing_interface() { "; let (client, _) = make_test_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -262,7 +271,7 @@ async fn test_config_import_invalid_key() { "; let (client, _) = make_test_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -321,7 +330,7 @@ async fn test_config_import_invalid_ip() { "; let (client, _) = make_test_client().await; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -354,7 +363,7 @@ async fn test_config_import_nonadmin() { PersistentKeepalive = 300 "; let (client, _) = make_test_client().await; - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); diff --git a/tests/wireguard_network_stats.rs b/tests/wireguard_network_stats.rs index 12caf1e50..71f69f97f 100644 --- a/tests/wireguard_network_stats.rs +++ b/tests/wireguard_network_stats.rs @@ -1,6 +1,5 @@ mod common; -use axum::http::StatusCode; use chrono::{Datelike, Duration, NaiveDate, SubsecRound, Timelike, Utc}; use defguard::{ db::{ @@ -11,6 +10,7 @@ use defguard::{ }, handlers::Auth, }; +use reqwest::StatusCode; use serde_json::{json, Value}; use self::common::make_test_client; @@ -24,6 +24,9 @@ fn make_network() -> Value { "allowed_ips": "10.1.1.0/24", "dns": "1.1.1.1", "allowed_groups": [], + "mfa_enabled": false, + "keepalive_interval": 25, + "peer_disconnect_threshold": 75 }) } @@ -32,7 +35,7 @@ async fn test_stats() { let (client, client_state) = make_test_client().await; let pool = client_state.pool; - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = &client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); diff --git a/tests/worker.rs b/tests/worker.rs index a6436c57f..702e3bb32 100644 --- a/tests/worker.rs +++ b/tests/worker.rs @@ -2,7 +2,6 @@ mod common; use std::sync::{Arc, Mutex}; -use axum::http::StatusCode; use defguard::{ grpc::{worker::JobStatus, WorkerDetail, WorkerState}, handlers::{ @@ -10,6 +9,7 @@ use defguard::{ Auth, }, }; +use reqwest::StatusCode; use self::common::{client::TestClient, make_test_client}; @@ -29,7 +29,7 @@ async fn test_scheduling_worker_jobs() { }; // normal user can only provision keys for themselves - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -57,7 +57,7 @@ async fn test_scheduling_worker_jobs() { assert_eq!(response.status(), StatusCode::FORBIDDEN); // admin user can provision keys for other users - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -146,7 +146,7 @@ async fn test_scheduling_worker_jobs() { assert_eq!(response.status(), StatusCode::OK); // // normal user can only fetch status of their own jobs - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -182,7 +182,7 @@ async fn test_worker_management_permissions() { } // admin can create worker tokens - let auth = Auth::new("admin".into(), "pass123".into()); + let auth = Auth::new("admin", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); @@ -203,7 +203,7 @@ async fn test_worker_management_permissions() { assert_eq!(workers.len(), 2); // normal user cannot create worker tokens - let auth = Auth::new("hpotter".into(), "pass123".into()); + let auth = Auth::new("hpotter", "pass123"); let response = client.post("/api/v1/auth").json(&auth).send().await; assert_eq!(response.status(), StatusCode::OK); diff --git a/web/src/i18n/en/index.ts b/web/src/i18n/en/index.ts index b55752654..6d6acb4e8 100644 --- a/web/src/i18n/en/index.ts +++ b/web/src/i18n/en/index.ts @@ -484,6 +484,7 @@ const en: BaseTranslation = { messages: { editSuccess: 'User updated.', failedToFetchUserData: 'Could not get user information.', + passwordResetEmailSent: 'Password reset email has been sent.', }, userDetails: { header: 'Profile Details', @@ -661,6 +662,7 @@ const en: BaseTranslation = { delete: 'Delete account', startEnrollment: 'Start enrollment', activateDesktop: 'Remote desktop activation', + resetPassword: 'Reset password', }, }, }, @@ -709,7 +711,8 @@ const en: BaseTranslation = { username: 'Username', }, error: { - usernameTaken: 'Username is already in use', + forbiddenCharacter: 'Field contains forbidden characters.', + usernameTaken: 'Username is already in use.', invalidKey: 'Key is invalid.', invalid: 'Field is invalid.', required: 'Field is required.', @@ -726,8 +729,8 @@ const en: BaseTranslation = { validPort: 'Enter a valid port.', validCode: 'Code should have 6 digits.', allowedIps: 'Only valid IP or domain is allowed.', - startFromNumber: 'Cannot start from number', - repeat: `Fields don't match`, + startFromNumber: 'Cannot start from number.', + repeat: `Fields don't match.`, }, floatingErrors: { title: 'Please correct the following:', @@ -1280,6 +1283,15 @@ const en: BaseTranslation = { label: 'Allowed groups', placeholder: 'All groups', }, + mfa_enabled: { + label: 'Require MFA for this Location', + }, + keepalive_interval: { + label: 'Keepalive interval', + }, + peer_disconnect_threshold: { + label: 'Peer disconnect threshold', + }, }, controls: { submit: 'Save changes', diff --git a/web/src/i18n/i18n-types.ts b/web/src/i18n/i18n-types.ts index 2e6a9ba32..c86f4eb14 100644 --- a/web/src/i18n/i18n-types.ts +++ b/web/src/i18n/i18n-types.ts @@ -1059,6 +1059,10 @@ type RootTranslation = { * C​o​u​l​d​ ​n​o​t​ ​g​e​t​ ​u​s​e​r​ ​i​n​f​o​r​m​a​t​i​o​n​. */ failedToFetchUserData: string + /** + * P​a​s​s​w​o​r​d​ ​r​e​s​e​t​ ​e​m​a​i​l​ ​h​a​s​ ​b​e​e​n​ ​s​e​n​t​. + */ + passwordResetEmailSent: string } userDetails: { /** @@ -1512,6 +1516,10 @@ type RootTranslation = { * R​e​m​o​t​e​ ​d​e​s​k​t​o​p​ ​a​c​t​i​v​a​t​i​o​n */ activateDesktop: string + /** + * R​e​s​e​t​ ​p​a​s​s​w​o​r​d + */ + resetPassword: string } } } @@ -1662,7 +1670,11 @@ type RootTranslation = { } error: { /** - * U​s​e​r​n​a​m​e​ ​i​s​ ​a​l​r​e​a​d​y​ ​i​n​ ​u​s​e + * F​i​e​l​d​ ​c​o​n​t​a​i​n​s​ ​f​o​r​b​i​d​d​e​n​ ​c​h​a​r​a​c​t​e​r​s​. + */ + forbiddenCharacter: string + /** + * U​s​e​r​n​a​m​e​ ​i​s​ ​a​l​r​e​a​d​y​ ​i​n​ ​u​s​e​. */ usernameTaken: string /** @@ -1730,11 +1742,11 @@ type RootTranslation = { */ allowedIps: string /** - * C​a​n​n​o​t​ ​s​t​a​r​t​ ​f​r​o​m​ ​n​u​m​b​e​r + * C​a​n​n​o​t​ ​s​t​a​r​t​ ​f​r​o​m​ ​n​u​m​b​e​r​. */ startFromNumber: string /** - * F​i​e​l​d​s​ ​d​o​n​'​t​ ​m​a​t​c​h + * F​i​e​l​d​s​ ​d​o​n​'​t​ ​m​a​t​c​h​. */ repeat: string } @@ -2991,6 +3003,24 @@ type RootTranslation = { */ placeholder: string } + mfa_enabled: { + /** + * R​e​q​u​i​r​e​ ​M​F​A​ ​f​o​r​ ​t​h​i​s​ ​L​o​c​a​t​i​o​n + */ + label: string + } + keepalive_interval: { + /** + * K​e​e​p​a​l​i​v​e​ ​i​n​t​e​r​v​a​l + */ + label: string + } + peer_disconnect_threshold: { + /** + * P​e​e​r​ ​d​i​s​c​o​n​n​e​c​t​ ​t​h​r​e​s​h​o​l​d + */ + label: string + } } controls: { /** @@ -4571,6 +4601,10 @@ export type TranslationFunctions = { * Could not get user information. */ failedToFetchUserData: () => LocalizedString + /** + * Password reset email has been sent. + */ + passwordResetEmailSent: () => LocalizedString } userDetails: { /** @@ -5024,6 +5058,10 @@ export type TranslationFunctions = { * Remote desktop activation */ activateDesktop: () => LocalizedString + /** + * Reset password + */ + resetPassword: () => LocalizedString } } } @@ -5172,7 +5210,11 @@ export type TranslationFunctions = { } error: { /** - * Username is already in use + * Field contains forbidden characters. + */ + forbiddenCharacter: () => LocalizedString + /** + * Username is already in use. */ usernameTaken: () => LocalizedString /** @@ -5240,11 +5282,11 @@ export type TranslationFunctions = { */ allowedIps: () => LocalizedString /** - * Cannot start from number + * Cannot start from number. */ startFromNumber: () => LocalizedString /** - * Fields don't match + * Fields don't match. */ repeat: () => LocalizedString } @@ -6491,6 +6533,24 @@ export type TranslationFunctions = { */ placeholder: () => LocalizedString } + mfa_enabled: { + /** + * Require MFA for this Location + */ + label: () => LocalizedString + } + keepalive_interval: { + /** + * Keepalive interval + */ + label: () => LocalizedString + } + peer_disconnect_threshold: { + /** + * Peer disconnect threshold + */ + label: () => LocalizedString + } } controls: { /** diff --git a/web/src/i18n/pl/index.ts b/web/src/i18n/pl/index.ts index 8c661ee30..e3c3d3a55 100644 --- a/web/src/i18n/pl/index.ts +++ b/web/src/i18n/pl/index.ts @@ -443,7 +443,7 @@ const pl: Translation = { qrInfo: 'Użyj poniższych konfiguracji aby połączyć się z wybranymi lokalizacjami.', helpers: { - qrHelper: `

Możesz skonfigurować Wireguard na telefonie skanując QR kod przez aplikację Wireguard.

`, + qrHelper: `

Możesz skonfigurować WireGuard na telefonie skanując QR kod przez aplikację Wireguard.

`, warningAutoMode: `

Uwaga, Defguard nie przechowuje twojego klucza prywatnego. Gdy opuścisz obecną stronę nie będziesz mógł pobrać ponownie konfiguracji z kluczem prywatnym.

`, @@ -469,6 +469,7 @@ Uwaga, konfiguracje tutaj podane, nie posiadają twojego klucza prywatnego. Musi messages: { editSuccess: 'Użytkownik zaktualizowany.', failedToFetchUserData: 'Błąd pobierania informacji o użtkowniku.', + passwordResetEmailSent: 'Email z resetem hasła został wysłany.', }, userDetails: { header: 'Szczegóły profilu', @@ -646,6 +647,7 @@ Uwaga, konfiguracje tutaj podane, nie posiadają twojego klucza prywatnego. Musi provision: 'Stwórz klucze na YubiKey', delete: 'Usuń konto', startEnrollment: 'Rozpocznij rejestrację', + resetPassword: 'Resetuj hasło', }, }, }, @@ -694,12 +696,13 @@ Uwaga, konfiguracje tutaj podane, nie posiadają twojego klucza prywatnego. Musi username: 'Nazwa użytkownika', }, error: { - usernameTaken: 'Nazwa użytkownika jest już w użyciu', + forbiddenCharacter: 'Pole zawiera niedozwolone znaki.', + usernameTaken: 'Nazwa użytkownika jest już w użyciu.', invalidKey: 'Klucz jest nieprawidłowy.', invalid: 'Pole jest nieprawidłowe.', required: 'Pole jest wymagane.', maximumLength: 'Maksymalna długość przekroczona.', - minimumLength: 'Minimalna długość nie została osiągnięta', + minimumLength: 'Minimalna długość nie została osiągnięta.', noSpecialChars: 'Nie wolno używać znaków specjalnych.', oneDigit: 'Wymagana jedna cyfra.', oneSpecial: 'Wymagany jest znak specjalny.', @@ -711,8 +714,8 @@ Uwaga, konfiguracje tutaj podane, nie posiadają twojego klucza prywatnego. Musi validPort: 'Wprowadź prawidłowy port.', validCode: 'Kod powinien mieć 6 cyfr.', allowedIps: 'Tylko poprawne adresy IP oraz domeny.', - startFromNumber: 'Nie może zaczynać się od liczby', - repeat: 'Wartości się nie pokrywają', + startFromNumber: 'Nie może zaczynać się od liczby.', + repeat: 'Wartości się nie pokrywają.', }, floatingErrors: { title: 'Popraw następujące błędy:', @@ -1265,6 +1268,15 @@ Uwaga, konfiguracje tutaj podane, nie posiadają twojego klucza prywatnego. Musi label: 'Dozwolone grupy', placeholder: 'Wszystkie grupy', }, + mfa_enabled: { + label: 'Wymagaj MFA dla tej lokalizacji', + }, + keepalive_interval: { + label: 'Utrzymanie połączenia', + }, + peer_disconnect_threshold: { + label: 'Peer disconnect threshold', + }, }, controls: { submit: 'Zapisz zmiany', diff --git a/web/src/pages/auth/Login/Login.tsx b/web/src/pages/auth/Login/Login.tsx index 6639f854e..baa46c258 100644 --- a/web/src/pages/auth/Login/Login.tsx +++ b/web/src/pages/auth/Login/Login.tsx @@ -17,7 +17,7 @@ import { import { useAuthStore } from '../../../shared/hooks/store/useAuthStore'; import useApi from '../../../shared/hooks/useApi'; import { MutationKeys } from '../../../shared/mutations'; -import { patternNoSpecialChars } from '../../../shared/patterns'; +import { patternSafeUsernameCharacters } from '../../../shared/patterns'; import { LoginData } from '../../../shared/types'; type Inputs = { @@ -34,7 +34,9 @@ export const Login = () => { username: yup .string() .required(LL.form.error.required()) - .matches(patternNoSpecialChars, LL.form.error.noSpecialChars()), + .matches(patternSafeUsernameCharacters, LL.form.error.forbiddenCharacter()) + .min(3, LL.form.error.minimumLength()) + .max(64, LL.form.error.maximumLength()), password: yup .string() .required(LL.form.error.required()) diff --git a/web/src/pages/network/NetworkEditForm/NetworkEditForm.tsx b/web/src/pages/network/NetworkEditForm/NetworkEditForm.tsx index b68529135..a4ddc9ae3 100644 --- a/web/src/pages/network/NetworkEditForm/NetworkEditForm.tsx +++ b/web/src/pages/network/NetworkEditForm/NetworkEditForm.tsx @@ -9,6 +9,7 @@ import * as yup from 'yup'; import { shallow } from 'zustand/shallow'; import { useI18nContext } from '../../../i18n/i18n-react'; +import { FormCheckBox } from '../../../shared/defguard-ui/components/Form/FormCheckBox/FormCheckBox.tsx'; import { FormInput } from '../../../shared/defguard-ui/components/Form/FormInput/FormInput'; import { FormSelect } from '../../../shared/defguard-ui/components/Form/FormSelect/FormSelect'; import { MessageBox } from '../../../shared/defguard-ui/components/Layout/MessageBox/MessageBox'; @@ -34,6 +35,9 @@ type FormFields = { allowed_groups: string[]; name: string; dns: string; + mfa_enabled: boolean; + keepalive_interval: number; + peer_disconnect_threshold: number; }; const defaultValues: FormFields = { @@ -44,6 +48,9 @@ const defaultValues: FormFields = { allowed_ips: '', allowed_groups: [], dns: '', + mfa_enabled: false, + keepalive_interval: 25, + peer_disconnect_threshold: 75, }; const networkToForm = (data?: Network): FormFields => { @@ -181,6 +188,17 @@ export const NetworkEditForm = () => { } return validateIpOrDomainList(val, ',', true); }), + mfa_enabled: yup.boolean().required(LL.form.error.required()), + keepalive_interval: yup + .number() + .positive() + .min(1) + .required(LL.form.error.required()), + peer_disconnect_threshold: yup + .number() + .positive() + .min(1) + .required(LL.form.error.required()), }) .required(); @@ -275,6 +293,19 @@ export const NetworkEditForm = () => { displayValue: titleCase(val), })} /> + + + diff --git a/web/src/pages/network/style.scss b/web/src/pages/network/style.scss index 509cc9399..185c669d1 100644 --- a/web/src/pages/network/style.scss +++ b/web/src/pages/network/style.scss @@ -118,6 +118,10 @@ margin-bottom: 32px; } } + + & > .form-checkbox { + margin-bottom: 25px; + } } } } diff --git a/web/src/pages/users/UserProfile/ProfileDetails/ProfileDetailsForm/ProfileDetailsForm.tsx b/web/src/pages/users/UserProfile/ProfileDetails/ProfileDetailsForm/ProfileDetailsForm.tsx index afd7a40f4..1ce400ef1 100644 --- a/web/src/pages/users/UserProfile/ProfileDetails/ProfileDetailsForm/ProfileDetailsForm.tsx +++ b/web/src/pages/users/UserProfile/ProfileDetails/ProfileDetailsForm/ProfileDetailsForm.tsx @@ -3,6 +3,7 @@ import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'; import { pick } from 'lodash-es'; import { useEffect, useMemo, useRef, useState } from 'react'; import { Controller, SubmitErrorHandler, SubmitHandler, useForm } from 'react-hook-form'; +import { useNavigate, useParams } from 'react-router'; import * as yup from 'yup'; import { useI18nContext } from '../../../../../i18n/i18n-react'; @@ -15,8 +16,7 @@ import useApi from '../../../../../shared/hooks/useApi'; import { useToaster } from '../../../../../shared/hooks/useToaster'; import { MutationKeys } from '../../../../../shared/mutations'; import { - patternNoSpecialChars, - patternStartsWithDigit, + patternSafeUsernameCharacters, patternValidEmail, patternValidPhoneNumber, } from '../../../../../shared/patterns'; @@ -60,6 +60,8 @@ export const ProfileDetailsForm = () => { user: { editUser }, groups: { getGroups }, } = useApi(); + const { username: paramsUsername } = useParams(); + const navigate = useNavigate(); const schema = useMemo( () => @@ -68,15 +70,9 @@ export const ProfileDetailsForm = () => { username: yup .string() .required(LL.form.error.required()) - .matches(patternNoSpecialChars, LL.form.error.noSpecialChars()) + .matches(patternSafeUsernameCharacters, LL.form.error.forbiddenCharacter()) .min(3, LL.form.error.minimumLength()) - .max(64, LL.form.error.maximumLength()) - .test('starts-with-number', LL.form.error.startFromNumber(), (value) => { - if (value && value.length) { - return !patternStartsWithDigit.test(value); - } - return false; - }), + .max(64, LL.form.error.maximumLength()), first_name: yup.string().required(LL.form.error.required()), last_name: yup.string().required(LL.form.error.required()), phone: yup @@ -130,11 +126,16 @@ export const ProfileDetailsForm = () => { [MutationKeys.EDIT_USER], editUser, { - onSuccess: () => { + onSuccess: (_data, variables) => { queryClient.invalidateQueries([QueryKeys.FETCH_USERS_LIST]); queryClient.invalidateQueries([QueryKeys.FETCH_USER_PROFILE]); toaster.success(LL.userPage.messages.editSuccess()); setUserProfile({ editMode: false, loading: false }); + // if username was changed redirect to new profile page + const newUsername = variables.data.username; + if (paramsUsername !== newUsername) { + navigate(`/admin/users/${variables.data.username}`, { replace: true }); + } }, onError: (err) => { toaster.error(LL.messages.error()); diff --git a/web/src/pages/users/UsersOverview/components/UserEditButton/ResetPasswordButton.tsx b/web/src/pages/users/UsersOverview/components/UserEditButton/ResetPasswordButton.tsx new file mode 100644 index 000000000..67330458c --- /dev/null +++ b/web/src/pages/users/UsersOverview/components/UserEditButton/ResetPasswordButton.tsx @@ -0,0 +1,42 @@ +import { useMutation } from '@tanstack/react-query'; + +import { useI18nContext } from '../../../../../i18n/i18n-react'; +import { EditButtonOption } from '../../../../../shared/defguard-ui/components/Layout/EditButton/EditButtonOption'; +import useApi from '../../../../../shared/hooks/useApi'; +import { useToaster } from '../../../../../shared/hooks/useToaster'; +import { MutationKeys } from '../../../../../shared/mutations'; +import { User } from '../../../../../shared/types'; + +type Props = { + user: User; +}; + +export const ResetPasswordButton = ({ user }: Props) => { + const { LL } = useI18nContext(); + const toaster = useToaster(); + + const { + user: { resetPassword }, + } = useApi(); + + const changePasswordMutation = useMutation(resetPassword, { + mutationKey: [MutationKeys.RESET_PASSWORD], + onSuccess: () => { + toaster.success(LL.userPage.messages.passwordResetEmailSent()); + }, + // eslint-disable-next-line @typescript-eslint/no-unused-vars + onError: (_err) => { + toaster.error(LL.messages.error()); + }, + }); + + return ( + { + changePasswordMutation.mutate({ username: user.username }); + }} + /> + ); +}; diff --git a/web/src/pages/users/UsersOverview/components/UserEditButton/UserEditButton.tsx b/web/src/pages/users/UsersOverview/components/UserEditButton/UserEditButton.tsx index 43d7d506f..3525c9516 100644 --- a/web/src/pages/users/UsersOverview/components/UserEditButton/UserEditButton.tsx +++ b/web/src/pages/users/UsersOverview/components/UserEditButton/UserEditButton.tsx @@ -10,6 +10,7 @@ import { useModalStore } from '../../../../../shared/hooks/store/useModalStore'; import { useUserProfileStore } from '../../../../../shared/hooks/store/useUserProfileStore'; import { User } from '../../../../../shared/types'; import { useAddUserModal } from '../../modals/AddUserModal/hooks/useAddUserModal'; +import { ResetPasswordButton } from './ResetPasswordButton'; type Props = { user: User; @@ -34,6 +35,7 @@ export const UserEditButton = ({ user }: Props) => { onClick={() => setChangePasswordModal({ visible: true, user })} /> )} + { username: yup .string() .required(LL.form.error.required()) - .matches(patternNoSpecialChars, LL.form.error.noSpecialChars()) - .matches(patternDigitOrLowercase, LL.form.error.invalid()) + .matches(patternSafeUsernameCharacters, LL.form.error.forbiddenCharacter()) .min(3, LL.form.error.minimumLength()) .max(64, LL.form.error.maximumLength()) - .test('starts-with-number', LL.form.error.startFromNumber(), (value) => { - if (value && value.length) { - return !patternStartsWithDigit.test(value); - } - return false; - }) .test( 'username-available', LL.form.error.usernameTaken(), diff --git a/web/src/pages/wizard/components/WizardNetworkConfiguration/WizardNetworkConfiguration.tsx b/web/src/pages/wizard/components/WizardNetworkConfiguration/WizardNetworkConfiguration.tsx index 02e32691a..c9370c1bd 100644 --- a/web/src/pages/wizard/components/WizardNetworkConfiguration/WizardNetworkConfiguration.tsx +++ b/web/src/pages/wizard/components/WizardNetworkConfiguration/WizardNetworkConfiguration.tsx @@ -8,6 +8,7 @@ import * as yup from 'yup'; import { shallow } from 'zustand/shallow'; import { useI18nContext } from '../../../../i18n/i18n-react'; +import { FormCheckBox } from '../../../../shared/defguard-ui/components/Form/FormCheckBox/FormCheckBox.tsx'; import { FormInput } from '../../../../shared/defguard-ui/components/Form/FormInput/FormInput'; import { FormSelect } from '../../../../shared/defguard-ui/components/Form/FormSelect/FormSelect'; import { Card } from '../../../../shared/defguard-ui/components/Layout/Card/Card'; @@ -130,6 +131,17 @@ export const WizardNetworkConfiguration = () => { return validateIpOrDomainList(val, ',', true); }), allowed_groups: yup.array().optional(), + mfa_enabled: yup.boolean().required(LL.form.error.required()), + keepalive_interval: yup + .number() + .positive() + .min(1) + .required(LL.form.error.required()), + peer_disconnect_threshold: yup + .number() + .positive() + .min(1) + .required(LL.form.error.required()), }) .required(), [LL.form.error], @@ -217,6 +229,19 @@ export const WizardNetworkConfiguration = () => { displayValue: titleCase(group), })} /> + + + diff --git a/web/src/pages/wizard/components/WizardNetworkConfiguration/style.scss b/web/src/pages/wizard/components/WizardNetworkConfiguration/style.scss index 96f866a7d..269f55821 100644 --- a/web/src/pages/wizard/components/WizardNetworkConfiguration/style.scss +++ b/web/src/pages/wizard/components/WizardNetworkConfiguration/style.scss @@ -20,5 +20,9 @@ & > .message-box { margin-bottom: 25px; } + + & > .form-checkbox { + margin-bottom: 25px; + } } } diff --git a/web/src/pages/wizard/hooks/useWizardStore.ts b/web/src/pages/wizard/hooks/useWizardStore.ts index 3facee36b..5d19275fb 100644 --- a/web/src/pages/wizard/hooks/useWizardStore.ts +++ b/web/src/pages/wizard/hooks/useWizardStore.ts @@ -25,6 +25,9 @@ const defaultValues: StoreFields = { allowed_ips: '', allowed_groups: [], dns: '', + mfa_enabled: false, + keepalive_interval: 25, + peer_disconnect_threshold: 75, }, }; @@ -76,6 +79,9 @@ type StoreFields = { allowed_ips: string; allowed_groups: string[]; dns?: string; + mfa_enabled: boolean; + keepalive_interval: number; + peer_disconnect_threshold: number; }; }; diff --git a/web/src/shared/hooks/useApi.tsx b/web/src/shared/hooks/useApi.tsx index f288d4066..53227383d 100644 --- a/web/src/shared/hooks/useApi.tsx +++ b/web/src/shared/hooks/useApi.tsx @@ -23,6 +23,7 @@ import { NetworkUserStats, OpenidClient, RemoveUserClientRequest, + ResetPasswordRequest, Settings, StartEnrollmentRequest, StartEnrollmentResponse, @@ -164,6 +165,9 @@ const useApi = (props?: HookProps): ApiHook => { const changePassword = ({ username, ...rest }: ChangePasswordRequest) => client.put(`/user/${username}/password`, rest); + const resetPassword = ({ username }: ResetPasswordRequest) => + client.post(`/user/${username}/reset_password`); + const startEnrollment = ({ username, ...rest }: StartEnrollmentRequest) => client .post(`/user/${username}/start_enrollment`, rest) @@ -427,6 +431,7 @@ const useApi = (props?: HookProps): ApiHook => { deleteUser, usernameAvailable, changePassword, + resetPassword, walletChallenge, setWallet, deleteWallet, diff --git a/web/src/shared/mutations.ts b/web/src/shared/mutations.ts index 4eb32dbb8..1cb4a0d17 100644 --- a/web/src/shared/mutations.ts +++ b/web/src/shared/mutations.ts @@ -7,6 +7,7 @@ export const MutationKeys = { REGISTER_SECURITY_KEY_FINISH: 'REGISTER_SECURITY_KEY_FINISH', CREATE_WORKER_JOB: 'CREATE_WORKER_JOB', CHANGE_PASSWORD: 'CHANGE_PASSWORD', + RESET_PASSWORD: 'RESET_PASSWORD', SET_WALLET: 'SET_WALLET', DELETE_WALLET: 'DELETE_WALLET', WALLET_CHALLENGE: 'WALLET_CHALLENGE', diff --git a/web/src/shared/patterns.ts b/web/src/shared/patterns.ts index 307b3ec84..1cb06ea8c 100644 --- a/web/src/shared/patterns.ts +++ b/web/src/shared/patterns.ts @@ -14,8 +14,6 @@ export const patternAtLeastOneLowerCaseChar = /(?=.*?[a-z])/g; export const patternAtLeastOneDigit = /(?=.*?[0-9])/g; -export const patternStartsWithDigit = /^\d/; - export const patternAtLeastOneSpecialChar = /(?=.*?[#?!@$%^&*-])/g; export const patternValidPhoneNumber = @@ -72,3 +70,8 @@ export const patternValidDomain = export const patternValidIp = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/; + +export const patternSafeUsernameCharacters = /^[a-zA-Z0-9]+[a-zA-Z0-9.\-_]+$/; + +export const patternSafePasswordCharacters = + /^[a-zA-Z0-9.!@#$%^&*()_+\-=\[\]{}|,<>\/?~]+$/; diff --git a/web/src/shared/types.ts b/web/src/shared/types.ts index d526a87b1..cbc797c28 100644 --- a/web/src/shared/types.ts +++ b/web/src/shared/types.ts @@ -119,6 +119,9 @@ export interface Network { allowed_ips?: string[]; allowed_groups?: string[]; dns?: string; + mfa_enabled: boolean; + keepalive_interval: number; + peer_disconnect_threshold: number; } export type ModifyNetworkRequest = { @@ -191,6 +194,10 @@ export interface ChangePasswordRequest { username: string; } +export interface ResetPasswordRequest { + username: string; +} + export interface WalletChallengeRequest { name?: string; username: string; @@ -364,6 +371,7 @@ export interface ApiHook { deleteUser: (user: User) => EmptyApiResponse; usernameAvailable: (username: string) => EmptyApiResponse; changePassword: (data: ChangePasswordRequest) => EmptyApiResponse; + resetPassword: (data: ResetPasswordRequest) => EmptyApiResponse; walletChallenge: (data: WalletChallengeRequest) => Promise; setWallet: (data: AddWalletRequest) => EmptyApiResponse; deleteWallet: (data: WalletChallengeRequest) => EmptyApiResponse; diff --git a/web/src/shared/validators/password.ts b/web/src/shared/validators/password.ts index 7b1ce2b11..319ae23d3 100644 --- a/web/src/shared/validators/password.ts +++ b/web/src/shared/validators/password.ts @@ -6,6 +6,7 @@ import { patternAtLeastOneLowerCaseChar, patternAtLeastOneSpecialChar, patternAtLeastOneUpperCaseChar, + patternSafePasswordCharacters, } from '../patterns'; export const passwordValidator = (LL: TranslationFunctions) => @@ -17,4 +18,5 @@ export const passwordValidator = (LL: TranslationFunctions) => .matches(patternAtLeastOneSpecialChar, LL.form.error.oneSpecial()) .matches(patternAtLeastOneUpperCaseChar, LL.form.error.oneUppercase()) .matches(patternAtLeastOneLowerCaseChar, LL.form.error.oneLowercase()) + .matches(patternSafePasswordCharacters, LL.form.error.forbiddenCharacter()) .required(LL.form.error.required());