peach-workspace/peach-web/src/routes/authentication.rs

use serde::{Serialize, Deserialize};
use rocket_contrib::json::{Json};
use log::{debug, info};
use rocket::request::{FlashMessage, Form};
use rocket::response::{Flash, Redirect};
use rocket::{get, post};
use rocket::request::FromForm;
use rocket_contrib::templates::Template;

use peach_lib::password_utils;

use crate::utils::{build_json_response, JsonResponse};
use crate::error::PeachWebError;


/// # helpers and routes for /login
/////////////////////////////////

#[derive(Debug, Serialize)]
pub struct LoginContext {
    pub back: Option<String>,
    pub flash_name: Option<String>,
    pub flash_msg: Option<String>,
    pub title: Option<String>,
}

impl LoginContext {
    pub fn build() -> LoginContext {
        LoginContext {
            back: None,
            flash_name: None,
            flash_msg: None,
            title: None,
        }
    }
}

#[get("/login")]
pub fn login(flash: Option<FlashMessage>) -> Template {
    let mut context = LoginContext::build();
    context.back = Some("/".to_string());
    context.title = Some("Login".to_string());
    // check to see if there is a flash message to display
    if let Some(flash) = flash {
        // add flash message contents to the context object
        context.flash_name = Some(flash.name().to_string());
        context.flash_msg = Some(flash.msg().to_string());
    };
    Template::render("login", &context)
}

/// # helpers and routes for /logout
/////////////////////////////////

#[post("/logout")]
pub fn logout() -> Flash<Redirect> {
    // logout authenticated user
    debug!("Attempting deauthentication of user.");
    /*
    match logout_user() {
        Ok(_) => Flash::success(Redirect::to("/"), "Logout success"),
        Err(_) => Flash::error(
            Redirect::to("/"),
            "Failed to logout",
        ),
    }
    */
    Flash::success(Redirect::to("/"), "Logged out")
}

/// # helpers and routes for /reset_password
//////////////////////////////////////////

#[derive(Debug, Deserialize, FromForm)]
pub struct ResetPasswordForm {
    pub temporary_password: String,
    pub new_password1: String,
    pub new_password2: String,
}

#[derive(Debug, Serialize)]
pub struct ResetPasswordContext {
    pub back: Option<String>,
    pub title: Option<String>,
    pub flash_name: Option<String>,
    pub flash_msg: Option<String>,
}

impl ResetPasswordContext {
    pub fn build() -> ResetPasswordContext {
        ResetPasswordContext {
            back: None,
            title: None,
            flash_name: None,
            flash_msg: None,
        }
    }
}

#[derive(Debug, Serialize)]
pub struct ChangePasswordContext {
    pub back: Option<String>,
    pub title: Option<String>,
    pub flash_name: Option<String>,
    pub flash_msg: Option<String>,
}

impl ChangePasswordContext {
    pub fn build() -> ChangePasswordContext {
        ChangePasswordContext {
            back: None,
            title: None,
            flash_name: None,
            flash_msg: None,
        }
    }
}

/// this function is publicly exposed for users who have forgotten their password
pub fn save_reset_password_form(password_form: ResetPasswordForm) -> Result<(), PeachWebError> {
    info!(
        "reset password!: {} {} {}",
        password_form.temporary_password, password_form.new_password1, password_form.new_password2
    );
    password_utils::verify_temporary_password(&password_form.temporary_password)?;
    // if the previous line did not throw an error, then the secret_link is correct
    password_utils::validate_new_passwords(
        &password_form.new_password1,
        &password_form.new_password2,
    )?;
    // if the previous line did not throw an error, then the new password is valid
    password_utils::set_new_password(&password_form.new_password1)?;
    Ok(())
}

/// this reset password route is used by a user who is not logged in
/// and is specifically for users who have forgotten their password
/// all routes under /public/* are excluded from nginx basic auth via the nginx config
#[get("/reset_password")]
pub fn reset_password(flash: Option<FlashMessage>) -> Template {
    let mut context = ResetPasswordContext::build();
    context.back = Some("/".to_string());
    context.title = Some("Reset Password".to_string());
    // check to see if there is a flash message to display
    if let Some(flash) = flash {
        // add flash message contents to the context object
        context.flash_name = Some(flash.name().to_string());
        context.flash_msg = Some(flash.msg().to_string());
    };
    Template::render("password/reset_password", &context)
}

/// this reset password route is used by a user who is not logged in
/// and is specifically for users who have forgotten their password
/// and is excluded from nginx basic auth via the nginx config
#[post("/reset_password", data = "<reset_password_form>")]
pub fn reset_password_post(reset_password_form: Form<ResetPasswordForm>) -> Template {
    let result = save_reset_password_form(reset_password_form.into_inner());
    match result {
        Ok(_) => {
            let mut context = ChangePasswordContext::build();
            context.back = Some("/".to_string());
            context.title = Some("Reset Password".to_string());
            context.flash_name = Some("success".to_string());
            let flash_msg = "New password is now saved. Return home to login".to_string();
            context.flash_msg = Some(flash_msg);
            Template::render("password/reset_password", &context)
        }
        Err(err) => {
            let mut context = ChangePasswordContext::build();
            // set back icon link to network route
            context.back = Some("/".to_string());
            context.title = Some("Reset Password".to_string());
            context.flash_name = Some("error".to_string());
            context.flash_msg = Some(format!("Failed to reset password: {}", err));
            Template::render("password/reset_password", &context)
        }
    }
}

/// this reset password route is used by a user who is not logged in
/// and is specifically for users who have forgotten their password
/// all routes under /public/* are excluded from nginx basic auth via the nginx config
#[post("/public/api/v1/reset_password", data = "<reset_password_form>")]
pub fn reset_password_form_endpoint(
    reset_password_form: Json<ResetPasswordForm>,
) -> Json<JsonResponse> {
    let result = save_reset_password_form(reset_password_form.into_inner());
    match result {
        Ok(_) => {
            let status = "success".to_string();
            let msg = "New password is now saved. Return home to login.".to_string();
            Json(build_json_response(status, None, Some(msg)))
        }
        Err(err) => {
            let status = "error".to_string();
            let msg = format!("{}", err);
            Json(build_json_response(status, None, Some(msg)))
        }
    }
}


/// # helpers and routes for /send_password_reset
////////////////////////////////////////////////


#[derive(Debug, Serialize)]
pub struct SendPasswordResetContext {
    pub back: Option<String>,
    pub title: Option<String>,
    pub flash_name: Option<String>,
    pub flash_msg: Option<String>,
}

impl SendPasswordResetContext {
    pub fn build() -> SendPasswordResetContext {
        SendPasswordResetContext {
            back: None,
            title: None,
            flash_name: None,
            flash_msg: None,
        }
    }
}

/// this route is used by a user who is not logged in to send a new password reset link
#[get("/send_password_reset")]
pub fn send_password_reset_page(flash: Option<FlashMessage>) -> Template {
    let mut context = SendPasswordResetContext::build();
    context.back = Some("/".to_string());
    context.title = Some("Send Password Reset".to_string());
    // check to see if there is a flash message to display
    if let Some(flash) = flash {
        // add flash message contents to the context object
        context.flash_name = Some(flash.name().to_string());
        context.flash_msg = Some(flash.msg().to_string());
    };
    Template::render("password/send_password_reset", &context)
}

/// this send_password_reset route is used by a user who is not logged in
/// and is specifically for users who have forgotten their password
#[post("/send_password_reset")]
pub fn send_password_reset_post() -> Template {
    info!("++ send password reset post");
    let result = password_utils::send_password_reset();
    match result {
        Ok(_) => {
            let mut context = ChangePasswordContext::build();
            context.back = Some("/".to_string());
            context.title = Some("Send Password Reset".to_string());
            context.flash_name = Some("success".to_string());
            let flash_msg =
                "A password reset link has been sent to the admin of this device".to_string();
            context.flash_msg = Some(flash_msg);
            Template::render("password/send_password_reset", &context)
        }
        Err(err) => {
            let mut context = ChangePasswordContext::build();
            context.back = Some("/".to_string());
            context.title = Some("Send Password Reset".to_string());
            context.flash_name = Some("error".to_string());
            context.flash_msg = Some(format!("Failed to send password reset link: {}", err));
            Template::render("password/send_password_reset", &context)
        }
    }
}

/// # helpers and routes for /settings/change_password
//////////////////////////////////////////

#[derive(Debug, Deserialize, FromForm)]
pub struct PasswordForm {
    pub old_password: String,
    pub new_password1: String,
    pub new_password2: String,
}

/// this function is for use by a user who is already logged in to change their password
pub fn save_password_form(password_form: PasswordForm) -> Result<(), PeachWebError> {
    info!(
        "change password!: {} {} {}",
        password_form.old_password, password_form.new_password1, password_form.new_password2
    );
    password_utils::verify_password(&password_form.old_password)?;
    // if the previous line did not throw an error, then the old password is correct
    password_utils::validate_new_passwords(
        &password_form.new_password1,
        &password_form.new_password2,
    )?;
    // if the previous line did not throw an error, then the new password is valid
    password_utils::set_new_password(&password_form.new_password1)?;
    Ok(())
}

/// this change password route is used by a user who is already logged in
#[get("/settings/change_password")]
pub fn change_password(flash: Option<FlashMessage>) -> Template {
    let mut context = ChangePasswordContext::build();
    // set back icon link to network route
    context.back = Some("/network".to_string());
    context.title = Some("Change Password".to_string());
    // check to see if there is a flash message to display
    if let Some(flash) = flash {
        // add flash message contents to the context object
        context.flash_name = Some(flash.name().to_string());
        context.flash_msg = Some(flash.msg().to_string());
    };
    Template::render("password/change_password", &context)
}

/// this change password route is used by a user who is already logged in
#[post("/settings/change_password", data = "<password_form>")]
pub fn change_password_post(password_form: Form<PasswordForm>) -> Template {
    let result = save_password_form(password_form.into_inner());
    match result {
        Ok(_) => {
            let mut context = ChangePasswordContext::build();
            // set back icon link to network route
            context.back = Some("/network".to_string());
            context.title = Some("Change Password".to_string());
            context.flash_name = Some("success".to_string());
            context.flash_msg = Some("New password is now saved".to_string());
            // template_dir is set in Rocket.toml
            Template::render("password/change_password", &context)
        }
        Err(err) => {
            let mut context = ChangePasswordContext::build();
            // set back icon link to network route
            context.back = Some("/network".to_string());
            context.title = Some("Configure DNS".to_string());
            context.flash_name = Some("error".to_string());
            context.flash_msg = Some(format!("Failed to save new password: {}", err));
            Template::render("password/change_password", &context)
        }
    }
}

#[post("/api/v1/settings/change_password", data = "<password_form>")]
pub fn save_password_form_endpoint(password_form: Json<PasswordForm>) -> Json<JsonResponse> {
    let result = save_password_form(password_form.into_inner());
    match result {
        Ok(_) => {
            let status = "success".to_string();
            let msg = "Your password was successfully changed".to_string();
            Json(build_json_response(status, None, Some(msg)))
        }
        Err(err) => {
            let status = "error".to_string();
            let msg = format!("{}", err);
            Json(build_json_response(status, None, Some(msg)))
        }
    }
}