1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.technical.auth
21 
22 import java.util.Date
23 import java.util.concurrent.TimeUnit
24 import com.google.common.cache.{Cache, CacheBuilder}
25 import grizzled.slf4j.Logging
26 import org.make.api.extensions.MakeSettingsComponent
27 import org.make.api.technical.auth.MakeDataHandler.{CreatedAtParameter, RefreshTokenExpirationParameter}
28 import org.make.api.technical.{IdGeneratorComponent, ShortenedNames}
29 import org.make.api.user.PersistentUserServiceComponent
30 import org.make.core.DateHelper
31 import org.make.core.auth._
32 import org.make.core.user.{User, UserId}
33 import scalaoauth2.provider._
34 
35 import scala.concurrent.ExecutionContext.Implicits.global
36 import scala.concurrent.Future
37 import scala.util.Success
38 
39 trait DefaultMakeDataHandlerComponent extends MakeDataHandlerComponent with Logging with ShortenedNames {
40   this: PersistentTokenServiceComponent
41     with PersistentUserServiceComponent
42     with ClientServiceComponent
43     with OauthTokenGeneratorComponent
44     with IdGeneratorComponent
45     with PersistentAuthCodeServiceComponent
46     with MakeSettingsComponent =>
47 
48   override lazy val oauth2DataHandler = new DefaultMakeDataHandler
49 
50   class DefaultMakeDataHandler extends MakeDataHandler {
51 
52     private val accessTokenCache: Cache[String, Token] =
53       CacheBuilder
54         .newBuilder()
55         .expireAfterWrite(5, TimeUnit.MINUTES)
56         .build[String, Token]()
57 
58     private val authInfoByAccessTokenCache: Cache[String, AuthInfo[UserRights]] =
59       CacheBuilder
60         .newBuilder()
61         .expireAfterWrite(5, TimeUnit.MINUTES)
62         .build[String, AuthInfo[UserRights]]()
63 
64     private def toAccessToken(token: Token): AccessToken = {
65       AccessToken(
66         token = token.accessToken,
67         refreshToken = token.refreshToken,
68         scope = token.scope,
69         lifeSeconds = Some(token.expiresIn.toLong),
70         createdAt = Date.from(token.createdAt.getOrElse(DateHelper.now()).toInstant),
71         params = Map(
72           CreatedAtParameter -> DateHelper.format(token.createdAt.getOrElse(DateHelper.now())),
73           RefreshTokenExpirationParameter -> token.refreshExpiresIn.toString
74         )
75       )
76     }
77 
78     private def userIsRelatedToClient(client: Client)(user: User): Boolean =
79       client.roles.isEmpty || user.roles.exists(client.roles.contains)
80 
81     override def validateClient(
82       maybeCredential: Option[ClientCredential],
83       request: AuthorizationRequest
84     ): Future[Boolean] = {
85       findClient(maybeCredential, request.grantType).map(_.isRight)
86     }
87 
88     private def findUser(client: Client, request: AuthorizationRequest): Future[Option[User]] = {
89       val eventualMaybeUser: Future[Option[User]] = request match {
90         case passwordRequest: PasswordRequest =>
91           persistentUserService
92             .findByEmailAndPassword(passwordRequest.username.toLowerCase, passwordRequest.password)
93         case reconnectRequest: ReconnectRequest =>
94           persistentUserService
95             .findByReconnectTokenAndPassword(
96               reconnectRequest.reconnectToken,
97               reconnectRequest.password,
98               client.reconnectExpirationSeconds
99             )
100         case _: ClientCredentialsRequest =>
101           client.defaultUserId match {
102             case Some(userId) => persistentUserService.get(userId)
103             case None         => Future.successful(None)
104           }
105         case _ => Future.successful(None)
106       }
107 
108       eventualMaybeUser.flatMap {
109         case Some(user) if !userIsRelatedToClient(client)(user) =>
110           Future.failed(new AccessDenied(MakeDataHandler.insufficientRole(user, client)))
111         case other => Future.successful(other)
112       }
113     }
114 
115     private def findClient(
116       maybeCredentials: Option[ClientCredential],
117       grantType: String
118     ): Future[Either[OAuthError, Client]] = {
119       (maybeCredentials match {
120         case None =>
121           // Do not use the default client when using the client credential grant type
122           if (grantType == OAuthGrantType.CLIENT_CREDENTIALS) {
123             Future.successful(
124               Left(new InvalidRequest("Client credentials are mandatory for the client_credentials grant type"))
125             )
126           } else {
127             clientService.getDefaultClient()
128           }
129         case Some(credentials) =>
130           clientService.getClient(ClientId(credentials.clientId), credentials.clientSecret)
131       }).map {
132         case Right(client) =>
133           if (client.allowedGrantTypes.contains(grantType)) {
134             Right(client)
135           } else {
136             Left(new UnauthorizedClient(s"Grant type $grantType is not allowed for this client"))
137           }
138         case error => error
139       }
140     }
141 
142     override def findUser(
143       maybeCredential: Option[ClientCredential],
144       request: AuthorizationRequest
145     ): Future[Option[UserRights]] = {
146 
147       findClient(maybeCredential, request.grantType).flatMap {
148         case Right(client) => findUser(client, request).map(_.map(UserRights.fromUser))
149         case Left(e)       => Future.failed(e)
150       }
151     }
152 
153     override def createAccessToken(authInfo: AuthInfo[UserRights]): Future[AccessToken] = {
154       val futureAccessTokens = oauthTokenGenerator.generateAccessToken()
155       val futureRefreshTokens = oauthTokenGenerator.generateRefreshToken()
156 
157       val clientId: String = authInfo.clientId.getOrElse(makeSettings.Authentication.defaultClientId)
158 
159       val futureClient = clientService.getClient(ClientId(clientId))
160       val futureResult: Future[Token] = for {
161         (accessToken, _)  <- futureAccessTokens
162         (refreshToken, _) <- futureRefreshTokens
163         maybeClient       <- futureClient
164         client <- maybeClient.fold(Future.failed[Client](new InvalidClient(s"Client with id $clientId not found")))(
165           Future.successful
166         )
167       } yield {
168         val maybeRefreshToken =
169           if (client.allowedGrantTypes.contains(OAuthGrantType.REFRESH_TOKEN)) {
170             Some(refreshToken)
171           } else {
172             None
173           }
174 
175         Token(
176           accessToken = accessToken,
177           refreshToken = maybeRefreshToken,
178           scope = None,
179           expiresIn = client.tokenExpirationSeconds,
180           refreshExpiresIn = client.refreshExpirationSeconds,
181           user = authInfo.user,
182           client = client
183         )
184       }
185 
186       futureResult
187         .flatMap(persistentTokenService.persist)
188         .map(toAccessToken)
189     }
190 
191     override def getStoredAccessToken(authInfo: AuthInfo[UserRights]): Future[Option[AccessToken]] = {
192       // Force to issue a fresh token every time a user connects.
193       // This way, authentication will not be shared across devices
194       Future.successful(None)
195     }
196 
197     override def refreshAccessToken(authInfo: AuthInfo[UserRights], refreshToken: String): Future[AccessToken] = {
198       def findByRefreshTokenOrFail(refreshToken: String): Future[Token] =
199         persistentTokenService.findByRefreshToken(refreshToken).flatMap {
200           case Some(token) => Future.successful(token)
201           case None        => Future.failed(TokenAlreadyRefreshed(refreshToken))
202         }
203 
204       for {
205         token       <- findByRefreshTokenOrFail(refreshToken)
206         _           <- persistentTokenService.deleteByAccessToken(token.accessToken)
207         accessToken <- createAccessToken(authInfo)
208       } yield accessToken
209     }
210 
211     override def findAuthInfoByCode(code: String): Future[Option[AuthInfo[UserRights]]] = {
212       persistentAuthCodeService.findByCode(code).flatMap {
213         case None => Future.successful(None)
214         case Some(authCode) =>
215           clientService.getClient(authCode.client).flatMap {
216             case Some(client) =>
217               persistentUserService
218                 .get(authCode.user)
219                 .flatMap {
220                   case Some(user) if userIsRelatedToClient(client)(user) =>
221                     Future.successful(
222                       Some(
223                         AuthInfo(
224                           user = UserRights(user.userId, user.roles, user.availableQuestions, user.emailVerified),
225                           clientId = Some(authCode.client.value),
226                           scope = authCode.scope,
227                           redirectUri = authCode.redirectUri
228                         )
229                       )
230                     )
231                   case None => Future.successful(None)
232                   case Some(user) =>
233                     Future.failed(new AccessDenied(MakeDataHandler.insufficientRole(user, client)))
234                 }
235             case _ => Future.successful(None)
236           }
237       }
238     }
239 
240     override def deleteAuthCode(code: String): Future[Unit] = {
241       persistentAuthCodeService.deleteByCode(code)
242     }
243 
244     override def findAuthInfoByRefreshToken(refreshToken: String): Future[Option[AuthInfo[UserRights]]] = {
245       persistentTokenService.findByRefreshToken(refreshToken).flatMap {
246         case Some(token) if !token.isRefreshTokenExpired =>
247           Future.successful(
248             Some(
249               AuthInfo(
250                 user = token.user,
251                 clientId = Some(token.client.clientId.value),
252                 scope = token.scope,
253                 redirectUri = None
254               )
255             )
256           )
257         case _ => Future.successful(None)
258       }
259     }
260 
261     override def findAuthInfoByAccessToken(accessToken: AccessToken): Future[Option[AuthInfo[UserRights]]] = {
262       Option(authInfoByAccessTokenCache.getIfPresent(accessToken.token))
263         .map(authInfo => Future.successful(Some(authInfo)))
264         .getOrElse {
265           persistentTokenService.get(accessToken.token).flatMap[Option[AuthInfo[UserRights]]] {
266             case Some(token) =>
267               val authInfo = AuthInfo(
268                 user = token.user,
269                 clientId = Some(token.client.clientId.value),
270                 scope = token.scope,
271                 redirectUri = None
272               )
273               authInfoByAccessTokenCache.put(accessToken.token, authInfo)
274               Future.successful(Some(authInfo))
275             case None => Future.successful(None)
276           }
277         }
278     }
279 
280     override def findAccessToken(token: String): Future[Option[AccessToken]] = {
281       Option(accessTokenCache.getIfPresent(token))
282         .filter(!_.isAccessTokenExpired)
283         .map(token => Future.successful(Some(token)))
284         .getOrElse {
285           val future = persistentTokenService
286             .get(token)
287             .map(_.filter(!_.isAccessTokenExpired))
288           future.onComplete {
289             case Success(Some(userToken)) => accessTokenCache.put(token, userToken)
290             case _                        =>
291           }
292           future
293         }
294         .map(_.map(toAccessToken))
295     }
296 
297     override def removeTokenByUserId(userId: UserId): Future[Int] = {
298       persistentTokenService.deleteByUserId(userId)
299     }
300 
301     override def createAuthorizationCode(
302       userId: UserId,
303       clientId: ClientId,
304       scope: Option[String],
305       redirectUri: Option[String]
306     ): Future[Option[AuthCode]] = {
307 
308       clientService.getClient(clientId).flatMap {
309         case None => Future.successful(None)
310         case Some(client) =>
311           persistentUserService.get(userId).flatMap {
312             case None => Future.successful(None)
313             case Some(user) if userIsRelatedToClient(client)(user) =>
314               persistentAuthCodeService
315                 .persist(
316                   AuthCode(
317                     authorizationCode = idGenerator.nextId(),
318                     scope = scope,
319                     redirectUri = redirectUri,
320                     createdAt = DateHelper.now(),
321                     expiresIn = client.tokenExpirationSeconds,
322                     user = userId,
323                     client = clientId
324                   )
325                 )
326                 .map(Some(_))
327             case Some(user) =>
328               Future.failed(new AccessDenied(MakeDataHandler.insufficientRole(user, client)))
329           }
330       }
331     }
332 
333     override def refreshIfTokenIsExpired(tokenValue: String): Future[Option[Token]] = {
334       Option(accessTokenCache.getIfPresent(tokenValue))
335         .map(token => Future.successful(Some(token)))
336         .getOrElse {
337           persistentTokenService.get(tokenValue)
338         }
339         .flatMap {
340           case Some(token @ Token(_, Some(refreshToken), _, _, _, _, _, _, _))
341               if token.isAccessTokenExpired &&
342                 !token.isRefreshTokenExpired =>
343             findAuthInfoByAccessToken(toAccessToken(token)).flatMap {
344               case Some(authInfo) =>
345                 refreshAccessToken(authInfo, refreshToken)
346                   .flatMap(token => persistentTokenService.get(token.token))
347               case _ => Future.successful(None)
348             }
349           case _ => Future.successful(None)
350         }
351     }
352 
353     override def removeToken(token: String): Future[Unit] = {
354       persistentTokenService.deleteByAccessToken(token).map(_ => accessTokenCache.invalidate(token))
355     }
356   }
357 }
358 
359 final case class TokenAlreadyRefreshed(refreshToken: String)
360     extends Exception(s"Refresh token $refreshToken has already been refreshed")