ef0b83a
use async_trait::async_trait;
use export::{AuthApi, KenAuthError};
use tonic::Request;
use crate::AuthService;
use crate::api::context::RequestMeta;
use crate::protos::auth as proto;
use crate::protos::auth::internal::v1::authority_service_server::AuthorityService;
use crate::protos::auth::v1::identity_service_server::IdentityService;
use crate::protos::auth::v1::mfa_service_server::MfaService;
use crate::protos::auth::v1::session_service_server::SessionService;
use crate::protos::auth::v1::ssh_key_service_server::SshKeyService;
pub mod authority;
pub mod context;
pub mod convert;
pub mod error;
pub mod identity;
pub mod mfa;
pub mod session;
pub mod ssh_key;
pub mod store;
impl AuthService {
fn identity(&self) -> crate::api::identity::IdentityApi {
crate::api::identity::IdentityApi::new(self.clone())
}
fn authority(&self) -> crate::api::authority::AuthorityApi {
crate::api::authority::AuthorityApi::new(self.clone())
}
fn session(&self) -> crate::api::session::SessionApi {
crate::api::session::SessionApi::new(self.clone())
}
fn ssh_key(&self) -> crate::api::ssh_key::SshKeyApi {
crate::api::ssh_key::SshKeyApi::new(self.clone())
}
fn mfa(&self) -> crate::api::mfa::MfaApi {
crate::api::mfa::MfaApi::new(self.clone())
}
pub fn read_request<T>(&self, message: T) -> Request<T> {
let mut request = Request::new(message);
request.set_timeout(self.read_timeout);
request.extensions_mut().insert(RequestMeta::internal());
request
}
pub fn write_request<T>(&self, message: T) -> Request<T> {
let mut request = Request::new(message);
request.set_timeout(self.write_timeout);
request.extensions_mut().insert(RequestMeta::internal());
request
}
}
#[async_trait]
impl AuthApi for AuthService {
async fn check_health(&self) -> Result<(), KenAuthError> {
self.cache()
.ping()
.await
.map_err(|error| KenAuthError::Unavailable(error.to_string()))
}
#[allow(clippy::too_many_arguments)]
async fn change_password(
&self,
user_id: i64,
old_password_hash: &str,
new_password_hash: &str,
keep_session_id: &str,
client_ip: &str,
) -> Result<proto::v1::ChangePasswordResponse, KenAuthError> {
let client = self.identity();
client
.change_password(self.write_request(proto::v1::ChangePasswordRequest {
user_id,
old_password_hash: old_password_hash.to_string(),
new_password_hash: new_password_hash.to_string(),
keep_session_id: keep_session_id.to_string(),
client_ip: client_ip.to_string(),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn get_mfa_status(
&self,
user_id: i64,
) -> Result<proto::v1::GetMfaStatusResponse, KenAuthError> {
let client = self.mfa();
client
.get_mfa_status(self.read_request(proto::v1::GetMfaStatusRequest { user_id }))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn configure_totp(
&self,
user_id: i64,
name: &str,
client_ip: &str,
) -> Result<proto::v1::ConfigureTotpResponse, KenAuthError> {
let client = self.mfa();
client
.configure_totp(self.write_request(proto::v1::ConfigureTotpRequest {
user_id,
name: name.to_string(),
client_ip: client_ip.to_string(),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn enable_totp(
&self,
user_id: i64,
code: &str,
password_hash: &str,
client_ip: &str,
) -> Result<proto::v1::EnableTotpResponse, KenAuthError> {
let client = self.mfa();
client
.enable_totp(self.write_request(proto::v1::EnableTotpRequest {
user_id,
code: code.to_string(),
password_hash: password_hash.to_string(),
client_ip: client_ip.to_string(),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn disable_totp(
&self,
user_id: i64,
code: &str,
client_ip: &str,
) -> Result<proto::v1::DisableTotpResponse, KenAuthError> {
let client = self.mfa();
client
.disable_totp(self.write_request(proto::v1::DisableTotpRequest {
user_id,
code: code.to_string(),
client_ip: client_ip.to_string(),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn regenerate_recovery_codes(
&self,
user_id: i64,
password_hash: &str,
client_ip: &str,
) -> Result<proto::v1::RegenerateRecoveryCodesResponse, KenAuthError> {
let client = self.mfa();
client
.regenerate_recovery_codes(self.write_request(
proto::v1::RegenerateRecoveryCodesRequest {
user_id,
password_hash: password_hash.to_string(),
client_ip: client_ip.to_string(),
},
))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
#[allow(clippy::too_many_arguments)]
async fn list_user_ssh_keys(
&self,
user_id: i64,
include_revoked: bool,
page: proto::common::v1::PageRequest,
) -> Result<proto::v1::ListUserSshKeysResponse, KenAuthError> {
let client = self.ssh_key();
client
.list_user_ssh_keys(self.read_request(proto::v1::ListUserSshKeysRequest {
user_id,
include_revoked,
page: Some(page),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn add_ssh_key(
&self,
user_id: i64,
name: &str,
public_key: &str,
description: &str,
client_ip: &str,
) -> Result<proto::v1::AddSshKeyResponse, KenAuthError> {
let client = self.ssh_key();
client
.add_ssh_key(self.write_request(proto::v1::AddSshKeyRequest {
user_id,
name: name.to_string(),
public_key: public_key.to_string(),
description: description.to_string(),
client_ip: client_ip.to_string(),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn revoke_ssh_key(
&self,
user_id: i64,
key_id: &str,
reason: &str,
bump_security_version: bool,
) -> Result<proto::v1::RevokeSshKeyResponse, KenAuthError> {
let client = self.ssh_key();
client
.revoke_ssh_key(self.write_request(proto::v1::RevokeSshKeyRequest {
user_id,
key_id: key_id.to_string(),
reason: reason.to_string(),
bump_security_version,
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn list_user_sessions(
&self,
user_id: i64,
include_revoked: bool,
include_expired: bool,
page: proto::common::v1::PageRequest,
) -> Result<proto::v1::ListUserSessionsResponse, KenAuthError> {
let client = self.session();
client
.list_user_sessions(self.read_request(proto::v1::ListUserSessionsRequest {
user_id,
include_revoked,
include_expired,
page: Some(page),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn revoke_user_sessions(
&self,
user_id: i64,
except_session_id: &str,
reason: &str,
bump_security_version: bool,
) -> Result<proto::v1::RevokeUserSessionsResponse, KenAuthError> {
let client = self.session();
client
.revoke_user_sessions(self.write_request(proto::v1::RevokeUserSessionsRequest {
user_id,
except_session_id: except_session_id.to_string(),
reason: reason.to_string(),
bump_security_version,
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner())
}
async fn get_session(
&self,
user_id: i64,
version: i32,
session_id: &str,
) -> Result<proto::internal::v1::AuthorityAccess, KenAuthError> {
let client = self.authority();
client
.get_session(self.read_request(proto::internal::v1::GetSessionRequest {
user_id,
version,
session_id: session_id.to_string(),
}))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner().access.unwrap_or_default())
}
async fn delete_account(&self, user_id: i64, reason: &str) -> Result<(), KenAuthError> {
let client = self.authority();
client
.delete_account(
self.write_request(proto::internal::v1::DeleteAccountRequest {
user_id,
reason: reason.to_string(),
}),
)
.await
.map_err(KenAuthError::from_status)?;
Ok(())
}
async fn cancel_account_deletion(&self, user_id: i64) -> Result<(), KenAuthError> {
let client = self.authority();
client
.cancel_account_deletion(
self.write_request(proto::internal::v1::CancelAccountDeletionRequest { user_id }),
)
.await
.map_err(KenAuthError::from_status)?;
Ok(())
}
async fn purge_account(&self, user_id: i64) -> Result<(), KenAuthError> {
let client = self.authority();
client
.purge_account(self.write_request(proto::internal::v1::PurgeAccountRequest { user_id }))
.await
.map_err(KenAuthError::from_status)?;
Ok(())
}
async fn batch_get_authority_users(
&self,
user_ids: Vec<i64>,
) -> Result<Vec<proto::internal::v1::AuthorityUser>, KenAuthError> {
let client = self.authority();
client
.batch_get_user(
self.read_request(proto::internal::v1::BatchGetUserRequest { user_ids }),
)
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner().users)
}
async fn get_user_status(
&self,
user_id: i64,
) -> Result<proto::common::v1::UserStatus, KenAuthError> {
let client = self.identity();
let user = Some(proto::common::v1::UserRef {
key: Some(proto::common::v1::user_ref::Key::UserId(user_id)),
});
client
.get_user_status(self.read_request(proto::v1::GetUserStatusRequest { user }))
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner().status.unwrap_or_default())
}
async fn get_user_public_by_ref(
&self,
key: proto::common::v1::user_ref::Key,
) -> Result<proto::common::v1::UserPublic, KenAuthError> {
let client = self.identity();
let user = Some(proto::common::v1::UserRef { key: Some(key) });
client
.get_user_public(self.read_request(proto::v1::GetUserPublicRequest { user }))
.await
.map_err(KenAuthError::from_status)?
.into_inner()
.user
.ok_or(KenAuthError::NotFound)
}
async fn get_authority_user(
&self,
user_id: i64,
) -> Result<proto::internal::v1::AuthorityUser, KenAuthError> {
let client = self.authority();
client
.get_user(self.read_request(proto::internal::v1::GetUserRequest { user_id }))
.await
.map_err(KenAuthError::from_status)?
.into_inner()
.user
.ok_or(KenAuthError::NotFound)
}
#[allow(clippy::too_many_arguments)]
async fn update_authority_user(
&self,
user_id: i64,
username: Option<String>,
displayname: Option<String>,
clear_displayname: bool,
public_show_email: Option<bool>,
version: i32,
) -> Result<proto::internal::v1::AuthorityUser, KenAuthError> {
let client = self.authority();
client
.update_user(self.write_request(proto::internal::v1::UpdateUserRequest {
user_id,
patch: Some(proto::internal::v1::AuthorityUserPatch {
version,
username,
displayname,
clear_displayname,
public_show_email,
}),
}))
.await
.map_err(KenAuthError::from_status)?
.into_inner()
.user
.ok_or(KenAuthError::NotFound)
}
async fn batch_get_user_public(
&self,
user_ids: Vec<i64>,
) -> Result<Vec<proto::common::v1::UserPublic>, KenAuthError> {
let client = self.identity();
client
.batch_get_user_public(
self.read_request(proto::v1::BatchGetUserPublicRequest { user_ids }),
)
.await
.map_err(KenAuthError::from_status)
.map(|response| response.into_inner().users)
}
async fn get_user_public(
&self,
user_id: i64,
) -> Result<proto::common::v1::UserPublic, KenAuthError> {
let client = self.identity();
let user = Some(proto::common::v1::UserRef {
key: Some(proto::common::v1::user_ref::Key::UserId(user_id)),
});
client
.get_user_public(self.read_request(proto::v1::GetUserPublicRequest { user }))
.await
.map_err(KenAuthError::from_status)?
.into_inner()
.user
.ok_or(KenAuthError::NotFound)
}
async fn revoke_session(
&self,
user_id: i64,
session_id: &str,
reason: &str,
) -> Result<(), KenAuthError> {
let client = self.session();
client
.revoke_session(self.write_request(proto::v1::RevokeSessionRequest {
user_id,
session_id: session_id.to_string(),
reason: reason.to_string(),
}))
.await
.map_err(KenAuthError::from_status)?;
Ok(())
}
async fn lookup_ssh_key(
&self,
public_key: &str,
) -> Result<Option<proto::common::v1::Principal>, KenAuthError> {
let client = self.ssh_key();
let response = client
.lookup_ssh_key(self.read_request(proto::v1::LookupSshKeyRequest {
fingerprint: String::new(),
public_key: public_key.to_string(),
require_active: true,
}))
.await
.map_err(KenAuthError::from_status)?
.into_inner();
if !response.found {
return Ok(None);
}
Ok(response.principal)
}
async fn ensure_bot_user(
&self,
username: &str,
displayname: &str,
system: bool,
) -> Result<proto::common::v1::UserPublic, KenAuthError> {
let client = self.identity();
client
.ensure_bot_user(self.write_request(proto::v1::EnsureBotUserRequest {
username: username.to_string(),
displayname: displayname.to_string(),
system,
}))
.await
.map_err(KenAuthError::from_status)?
.into_inner()
.user
.ok_or(KenAuthError::NotFound)
}
}