2019-05-03 06:17:27 +08:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-08-15 15:58:33 +08:00
|
|
|
class UserApiKeysController < ApplicationController
|
2016-08-16 13:10:32 +08:00
|
|
|
layout "no_ember"
|
2016-08-15 15:58:33 +08:00
|
|
|
|
2019-04-02 01:18:53 +08:00
|
|
|
requires_login only: %i[create create_otp revoke undo_revoke]
|
2024-06-25 19:32:18 +08:00
|
|
|
skip_before_action :redirect_to_login_if_required,
|
|
|
|
:redirect_to_profile_if_required,
|
|
|
|
only: %i[new otp]
|
2017-08-31 12:06:56 +08:00
|
|
|
skip_before_action :check_xhr, :preload_json
|
2016-08-15 15:58:33 +08:00
|
|
|
|
2024-10-16 10:09:07 +08:00
|
|
|
AUTH_API_VERSION = 4
|
2016-08-17 07:58:19 +08:00
|
|
|
|
2016-08-15 15:58:33 +08:00
|
|
|
def new
|
2016-08-17 07:58:19 +08:00
|
|
|
if request.head?
|
|
|
|
head :ok, auth_api_version: AUTH_API_VERSION
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2024-11-09 01:05:03 +08:00
|
|
|
find_client
|
2016-08-16 13:10:32 +08:00
|
|
|
require_params
|
2016-08-23 14:48:00 +08:00
|
|
|
validate_params
|
2016-08-16 13:10:32 +08:00
|
|
|
|
|
|
|
unless current_user
|
|
|
|
cookies[:destination_url] = request.fullpath
|
2016-09-16 11:48:50 +08:00
|
|
|
|
2021-02-08 18:04:33 +08:00
|
|
|
if SiteSetting.enable_discourse_connect?
|
2016-09-16 11:48:50 +08:00
|
|
|
redirect_to path("/session/sso")
|
|
|
|
else
|
|
|
|
redirect_to path("/login")
|
|
|
|
end
|
2016-08-16 13:10:32 +08:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2016-09-12 13:42:06 +08:00
|
|
|
unless meets_tl?
|
2016-08-23 14:48:00 +08:00
|
|
|
@no_trust_level = true
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2024-11-09 01:05:03 +08:00
|
|
|
@application_name = params[:application_name] || @client&.application_name
|
|
|
|
@public_key = params[:public_key] || @client&.public_key
|
2016-08-16 13:10:32 +08:00
|
|
|
@nonce = params[:nonce]
|
|
|
|
@client_id = params[:client_id]
|
|
|
|
@auth_redirect = params[:auth_redirect]
|
|
|
|
@push_url = params[:push_url]
|
2016-10-14 13:05:27 +08:00
|
|
|
@localized_scopes = params[:scopes].split(",").map { |s| I18n.t("user_api_key.scopes.#{s}") }
|
|
|
|
@scopes = params[:scopes]
|
2016-08-23 14:48:00 +08:00
|
|
|
rescue Discourse::InvalidAccess
|
|
|
|
@generic_error = true
|
2016-08-15 15:58:33 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
def create
|
2024-11-09 01:05:03 +08:00
|
|
|
find_client
|
2016-08-16 13:10:32 +08:00
|
|
|
require_params
|
|
|
|
|
2019-04-02 01:18:53 +08:00
|
|
|
if params.key?(:auth_redirect)
|
2024-11-09 01:05:03 +08:00
|
|
|
if UserApiKeyClient.invalid_auth_redirect?(params[:auth_redirect], client: @client)
|
|
|
|
raise Discourse::InvalidAccess
|
|
|
|
end
|
2016-08-15 15:58:33 +08:00
|
|
|
end
|
|
|
|
|
2016-09-12 13:42:06 +08:00
|
|
|
raise Discourse::InvalidAccess unless meets_tl?
|
2016-08-15 15:58:33 +08:00
|
|
|
|
2016-08-16 13:10:32 +08:00
|
|
|
validate_params
|
2019-04-02 01:18:53 +08:00
|
|
|
scopes = params[:scopes].split(",")
|
2016-08-15 15:58:33 +08:00
|
|
|
|
2024-11-09 01:05:03 +08:00
|
|
|
@client = UserApiKeyClient.new(client_id: params[:client_id]) if @client.blank?
|
|
|
|
@client.application_name = params[:application_name] if params[:application_name].present?
|
|
|
|
@client.public_key = params[:public_key] if params[:public_key].present?
|
|
|
|
@client.save! if @client.new_record? || @client.changed?
|
|
|
|
|
|
|
|
# destroy any old keys the user had with the client
|
|
|
|
@client.keys.where(user_id: current_user.id).destroy_all
|
2016-08-16 15:06:33 +08:00
|
|
|
|
2016-08-15 15:58:33 +08:00
|
|
|
key =
|
2024-11-09 01:05:03 +08:00
|
|
|
@client.keys.create!(
|
2016-08-15 15:58:33 +08:00
|
|
|
user_id: current_user.id,
|
2016-10-14 13:05:27 +08:00
|
|
|
push_url: params[:push_url],
|
2020-09-29 17:57:48 +08:00
|
|
|
scopes: scopes.map { |name| UserApiKeyScope.new(name: name) },
|
2016-08-15 15:58:33 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
# we keep the payload short so it encrypts easily with public key
|
|
|
|
# it is often restricted to 128 chars
|
2019-01-04 11:46:18 +08:00
|
|
|
@payload = {
|
2016-08-15 15:58:33 +08:00
|
|
|
key: key.key,
|
|
|
|
nonce: params[:nonce],
|
2016-10-14 13:05:27 +08:00
|
|
|
push: key.has_push?,
|
|
|
|
api: AUTH_API_VERSION,
|
2016-08-15 15:58:33 +08:00
|
|
|
}.to_json
|
|
|
|
|
2024-11-09 01:05:03 +08:00
|
|
|
public_key = OpenSSL::PKey::RSA.new(@client.public_key)
|
2019-01-04 11:46:18 +08:00
|
|
|
@payload = Base64.encode64(public_key.public_encrypt(@payload))
|
|
|
|
|
2019-04-02 01:18:53 +08:00
|
|
|
if scopes.include?("one_time_password")
|
|
|
|
# encrypt one_time_password separately to bypass 128 chars encryption limit
|
|
|
|
otp_payload = one_time_password(public_key, current_user.username)
|
|
|
|
end
|
|
|
|
|
2019-01-04 11:46:18 +08:00
|
|
|
if params[:auth_redirect]
|
2019-07-24 00:16:03 +08:00
|
|
|
uri = URI.parse(params[:auth_redirect])
|
|
|
|
query_attributes = [uri.query, "payload=#{CGI.escape(@payload)}"]
|
|
|
|
if scopes.include?("one_time_password")
|
|
|
|
query_attributes << "oneTimePassword=#{CGI.escape(otp_payload)}"
|
2023-01-09 20:20:10 +08:00
|
|
|
end
|
2019-07-24 00:16:03 +08:00
|
|
|
uri.query = query_attributes.compact.join("&")
|
|
|
|
|
2022-03-21 22:28:52 +08:00
|
|
|
redirect_to(uri.to_s, allow_other_host: true)
|
2019-01-04 11:46:18 +08:00
|
|
|
else
|
|
|
|
respond_to do |format|
|
|
|
|
format.html { render :show }
|
|
|
|
format.json do
|
2024-11-09 01:05:03 +08:00
|
|
|
instructions =
|
|
|
|
I18n.t("user_api_key.instructions", application_name: @client.application_name)
|
2019-01-04 11:46:18 +08:00
|
|
|
render json: { payload: @payload, instructions: instructions }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2016-08-15 15:58:33 +08:00
|
|
|
end
|
|
|
|
|
2019-04-02 01:18:53 +08:00
|
|
|
def otp
|
|
|
|
require_params_otp
|
|
|
|
|
|
|
|
unless current_user
|
|
|
|
cookies[:destination_url] = request.fullpath
|
|
|
|
|
2021-02-08 18:04:33 +08:00
|
|
|
if SiteSetting.enable_discourse_connect?
|
2019-04-02 01:18:53 +08:00
|
|
|
redirect_to path("/session/sso")
|
|
|
|
else
|
|
|
|
redirect_to path("/login")
|
|
|
|
end
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
@application_name = params[:application_name]
|
|
|
|
@public_key = params[:public_key]
|
|
|
|
@auth_redirect = params[:auth_redirect]
|
|
|
|
end
|
|
|
|
|
|
|
|
def create_otp
|
|
|
|
require_params_otp
|
|
|
|
|
2024-11-09 01:05:03 +08:00
|
|
|
if UserApiKeyClient.invalid_auth_redirect?(params[:auth_redirect])
|
|
|
|
raise Discourse::InvalidAccess
|
|
|
|
end
|
2019-04-02 01:18:53 +08:00
|
|
|
raise Discourse::InvalidAccess unless meets_tl?
|
|
|
|
|
|
|
|
public_key = OpenSSL::PKey::RSA.new(params[:public_key])
|
|
|
|
otp_payload = one_time_password(public_key, current_user.username)
|
|
|
|
|
|
|
|
redirect_path = "#{params[:auth_redirect]}?oneTimePassword=#{CGI.escape(otp_payload)}"
|
2022-03-21 22:28:52 +08:00
|
|
|
redirect_to(redirect_path, allow_other_host: true)
|
2019-04-02 01:18:53 +08:00
|
|
|
end
|
|
|
|
|
2016-08-16 15:06:33 +08:00
|
|
|
def revoke
|
2016-09-02 15:08:46 +08:00
|
|
|
revoke_key = find_key if params[:id]
|
|
|
|
|
2016-09-02 14:57:41 +08:00
|
|
|
if current_key = request.env["HTTP_USER_API_KEY"]
|
2020-04-07 21:42:52 +08:00
|
|
|
request_key = UserApiKey.with_key(current_key).first
|
2016-09-02 15:08:46 +08:00
|
|
|
revoke_key ||= request_key
|
2016-09-02 14:57:41 +08:00
|
|
|
end
|
|
|
|
|
2016-09-02 15:08:46 +08:00
|
|
|
raise Discourse::NotFound unless revoke_key
|
|
|
|
|
2016-09-02 14:57:41 +08:00
|
|
|
revoke_key.update_columns(revoked_at: Time.zone.now)
|
|
|
|
|
2016-08-16 15:06:33 +08:00
|
|
|
render json: success_json
|
|
|
|
end
|
|
|
|
|
|
|
|
def undo_revoke
|
|
|
|
find_key.update_columns(revoked_at: nil)
|
|
|
|
render json: success_json
|
|
|
|
end
|
|
|
|
|
|
|
|
def find_key
|
|
|
|
key = UserApiKey.find(params[:id])
|
2019-12-17 18:56:16 +08:00
|
|
|
raise Discourse::InvalidAccess unless current_user.admin || key.user_id == current_user.id
|
2016-08-16 15:06:33 +08:00
|
|
|
key
|
|
|
|
end
|
|
|
|
|
2024-11-09 01:05:03 +08:00
|
|
|
def find_client
|
|
|
|
@client = UserApiKeyClient.find_by(client_id: params[:client_id])
|
|
|
|
end
|
|
|
|
|
2016-08-16 13:10:32 +08:00
|
|
|
def require_params
|
2024-11-09 01:05:03 +08:00
|
|
|
%i[nonce scopes client_id].each { |p| params.require(p) }
|
|
|
|
params.require(:public_key) if @client&.public_key.blank?
|
|
|
|
params.require(:application_name) if @client&.application_name.blank?
|
2016-08-16 13:10:32 +08:00
|
|
|
end
|
|
|
|
|
2016-08-26 11:23:06 +08:00
|
|
|
def validate_params
|
2016-10-14 13:05:27 +08:00
|
|
|
requested_scopes = Set.new(params[:scopes].split(","))
|
|
|
|
raise Discourse::InvalidAccess unless UserApiKey.allowed_scopes.superset?(requested_scopes)
|
2016-08-16 13:10:32 +08:00
|
|
|
|
|
|
|
# our pk has got to parse
|
2024-11-09 01:05:03 +08:00
|
|
|
OpenSSL::PKey::RSA.new(params[:public_key]) if params[:public_key]
|
2016-08-16 13:10:32 +08:00
|
|
|
end
|
|
|
|
|
2019-04-02 01:18:53 +08:00
|
|
|
def require_params_otp
|
|
|
|
%i[public_key auth_redirect application_name].each { |p| params.require(p) }
|
|
|
|
end
|
|
|
|
|
2016-09-12 13:42:06 +08:00
|
|
|
def meets_tl?
|
2024-01-19 11:25:24 +08:00
|
|
|
current_user.staff? || current_user.in_any_groups?(SiteSetting.user_api_key_allowed_groups_map)
|
2016-09-12 13:42:06 +08:00
|
|
|
end
|
|
|
|
|
2019-04-02 01:18:53 +08:00
|
|
|
def one_time_password(public_key, username)
|
|
|
|
unless UserApiKey.allowed_scopes.superset?(Set.new(["one_time_password"]))
|
|
|
|
raise Discourse::InvalidAccess
|
2023-01-09 20:20:10 +08:00
|
|
|
end
|
2019-04-02 01:18:53 +08:00
|
|
|
|
|
|
|
otp = SecureRandom.hex
|
2019-12-03 17:05:53 +08:00
|
|
|
Discourse.redis.setex "otp_#{otp}", 10.minutes, username
|
2019-04-02 01:18:53 +08:00
|
|
|
|
|
|
|
Base64.encode64(public_key.public_encrypt(otp))
|
|
|
|
end
|
2016-08-15 15:58:33 +08:00
|
|
|
end
|