1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.technical.auth
21 
22 import akka.http.scaladsl.model.StatusCodes
23 import akka.http.scaladsl.model.headers.{Authorization, HttpChallenges}
24 import akka.http.scaladsl.server.AuthenticationFailedRejection.CredentialsMissing
25 import akka.http.scaladsl.server.directives.Credentials
26 import akka.http.scaladsl.server.{AuthenticationFailedRejection, Directive1}
27 import cats.data.OptionT
28 import cats.syntax.option._
29 import org.make.api.operation.OperationServiceComponent
30 import org.make.api.question.QuestionServiceComponent
31 import org.make.api.technical.MakeDirectives.MakeDirectivesDependencies
32 import org.make.api.technical.{MakeDirectives, OidcAuthenticationNeededRejection, ShortenedNames}
33 import org.make.core.ApplicationName
34 import org.make.core.auth.UserRights
35 import org.make.core.operation.SimpleOperation
36 import org.make.core.operation.OperationKind.SecuredConsultation
37 import org.make.core.question.{Question, QuestionId}
38 import org.make.core.user.Role.{RoleAdmin, RoleSuperAdmin}
39 import scalaoauth2.provider._
40 
41 import java.time.Instant
42 import scala.concurrent.{Await, Future}
43 import scala.concurrent.ExecutionContext.Implicits.global
44 import scala.concurrent.duration._
45 
46 /**
47   * Mostly taken from https://github.com/nulab/akka-http-oauth2-provider with added support for redirect
48   */
49 trait MakeAuthentication extends ShortenedNames with MakeDirectives {
50   self: MakeDirectivesDependencies with QuestionServiceComponent with OperationServiceComponent =>
51 
52   val realm = "make.org API"
53 
54   // Admins and Super Admins can access secured operations without OIDC
55   private val OIDC_ALLOWED_MAKE_ROLES = List(RoleAdmin, RoleSuperAdmin)
56 
57   def oidcAuth(questionId: QuestionId, now: Instant = Instant.now()): Directive1[AuthInfo[UserRights]] =
58     makeOAuth2.flatMap { authInfo =>
59       val securedOperation = Await.result(getSecuredOperation(questionService.getQuestion(questionId)), 5.seconds)
60       securedOperation match {
61         case Some(operation -> _) =>
62           if (authInfo.user.roles.intersect(OIDC_ALLOWED_MAKE_ROLES).nonEmpty) provide(authInfo)
63           else {
64             val nowSeconds = now.toEpochMilli / 1000
65             authInfo.user.oidcInfos.flatMap(_.get(operation.operationId)) match {
66               case Some(oidcInfo) if oidcInfo.exp >= nowSeconds => provide(authInfo)
67               case Some(oidcInfo) if oidcInfo.exp < nowSeconds =>
68                 reject(OidcAuthenticationNeededRejection(StatusCodes.Forbidden, None))
69               case _ => reject(OidcAuthenticationNeededRejection(StatusCodes.Forbidden, None))
70             }
71           }
72         case None => provide(authInfo)
73       }
74     }
75 
76   def optionalOidcAuth(questionId: QuestionId, now: Instant = Instant.now()): Directive1[Option[AuthInfo[UserRights]]] =
77     optionalOidcAuthBySlug(questionId.value, now, Some(questionService.getQuestion(questionId)))
78 
79   def optionalOidcAuthBySlug(
80     questionSlugOrQuestionId: String,
81     now: Instant = Instant.now(),
82     getQuestion: Option[Future[Option[Question]]] = None,
83     oidcConfigOnErrorResponse: Boolean = false
84   ): Directive1[Option[AuthInfo[UserRights]]] = {
85     optionalMakeOAuth2.flatMap { maybeAuthInfo =>
86       val securedOperation = Await.result(
87         getSecuredOperation(
88           getQuestion.getOrElse(questionService.getQuestionByQuestionIdValueOrSlug(questionSlugOrQuestionId))
89         ),
90         5.seconds
91       )
92       (securedOperation, maybeAuthInfo) match {
93         // Admins can access secured operations without OIDC
94         case (Some(_), Some(authInfo)) if authInfo.user.roles.intersect(OIDC_ALLOWED_MAKE_ROLES).nonEmpty =>
95           provide(maybeAuthInfo)
96         case (Some(operation -> questionId), Some(authInfo)) =>
97           val nowSeconds = now.toEpochMilli / 1000
98           authInfo.user.oidcInfos.flatMap(_.get(operation.operationId)) match {
99             case Some(oidcInfo) if oidcInfo.exp >= nowSeconds => provide(maybeAuthInfo)
100             case Some(oidcInfo) if oidcInfo.exp < nowSeconds =>
101               if (oidcConfigOnErrorResponse)
102                 reject(
103                   OidcAuthenticationNeededRejection(
104                     StatusCodes.Forbidden,
105                     operation.operationAuthentication.flatMap(_.oidc.map(_.simple(questionId)))
106                   )
107                 )
108               else reject(OidcAuthenticationNeededRejection(StatusCodes.Forbidden, None))
109             case _ =>
110               if (oidcConfigOnErrorResponse)
111                 reject(
112                   OidcAuthenticationNeededRejection(
113                     StatusCodes.Forbidden,
114                     operation.operationAuthentication.flatMap(_.oidc.map(_.simple(questionId)))
115                   )
116                 )
117               else reject(OidcAuthenticationNeededRejection(StatusCodes.Forbidden, None))
118           }
119         case (Some(operation -> questionId), None) =>
120           if (oidcConfigOnErrorResponse)
121             reject(
122               OidcAuthenticationNeededRejection(
123                 StatusCodes.Unauthorized,
124                 operation.operationAuthentication.flatMap(_.oidc.map(_.simple(questionId)))
125               )
126             )
127           else reject(OidcAuthenticationNeededRejection(StatusCodes.Unauthorized, None))
128         case (None, _) => provide(maybeAuthInfo)
129       }
130     }
131   }
132 
133   private def getSecuredOperation(
134     getQuestion: Future[Option[Question]]
135   ): Future[Option[(SimpleOperation, QuestionId)]] = {
136     (for {
137       question                <- OptionT(getQuestion)
138       operationId             <- question.operationId.toOptionT[Future]
139       operation               <- OptionT(operationService.findOneSimple(operationId))
140       operationAuthentication <- operation.operationAuthentication.toOptionT[Future]
141       if operation.operationKind == SecuredConsultation
142       _ <- operationAuthentication.oidc.toOptionT[Future]
143     } yield operation -> question.questionId).value
144   }
145 
146   def makeOAuth2: Directive1[AuthInfo[UserRights]] = {
147     authenticateOAuth2Async[AuthInfo[UserRights]](realm, oauth2Authenticator)
148   }
149 
150   def optionalMakeOAuth2: Directive1[Option[AuthInfo[UserRights]]] = {
151     makeOAuth2.map(Some(_): Option[AuthInfo[UserRights]]).recover {
152       case AuthenticationFailedRejection(_, _) +: _ => provide(None)
153       case rejections                               => reject(rejections: _*)
154     }
155   }
156 
157   private def oauth2Authenticator(credentials: Credentials): Future[Option[AuthInfo[UserRights]]] =
158     credentials match {
159       case Credentials.Provided(token) =>
160         oauth2DataHandler.findAccessToken(token).flatMap {
161           case Some(t) => oauth2DataHandler.findAuthInfoByAccessToken(t)
162           case None    => Future.successful(None)
163         }
164       case _ => Future.successful(None)
165     }
166 
167   def secureCookieValue(applicationName: Option[ApplicationName]): Directive1[Option[String]] = {
168     optionalCookieValue(makeSettings.SecureCookie.name, applicationName)
169   }
170 
171   def extractToken(applicationName: Option[ApplicationName]): Directive1[Option[String]] = {
172     for {
173       maybeCookie        <- secureCookieValue(applicationName)
174       maybeAuthorization <- optionalHeaderValueByType(Authorization)
175     } yield maybeCookie.orElse(maybeAuthorization.map(_.credentials.token()))
176   }
177 
178   def requireToken(applicationName: Option[ApplicationName]): Directive1[String] = {
179     extractToken(applicationName).flatMap {
180       case Some(token) => provide(token)
181       case None =>
182         mapInnerRoute { _ =>
183           reject(AuthenticationFailedRejection(cause = CredentialsMissing, challenge = HttpChallenges.oAuth2(realm)))
184         }.tmap(_ => "")
185     }
186   }
187 }