1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.technical.security
21 
22 import akka.http.scaladsl.model.StatusCodes
23 import akka.http.scaladsl.server.{Directives, Route}
24 import io.circe.generic.semiauto.{deriveDecoder, deriveEncoder}
25 import io.circe.{Decoder, Encoder}
26 import io.swagger.annotations._
27 import org.make.api.operation.OperationServiceComponent
28 import org.make.api.question.QuestionServiceComponent
29 
30 import javax.ws.rs.Path
31 import org.make.api.technical.MakeDirectives.MakeDirectivesDependencies
32 import org.make.api.technical.{ActorSystemComponent, EndpointType, MakeAuthenticationDirectives}
33 import org.make.core.HttpCodes
34 import org.make.core.auth.UserRights
35 import scalaoauth2.provider.AuthInfo
36 
37 @Api(value = "Security")
38 @Path(value = "/")
39 trait SecurityApi extends Directives {
40 
41   @Path(value = "/admin/security/secure-hash")
42   @ApiOperation(
43     value = "create-secure-hash",
44     httpMethod = "POST",
45     code = HttpCodes.OK,
46     authorizations = Array(
47       new Authorization(
48         value = "MakeApi",
49         scopes = Array(new AuthorizationScope(scope = "admin", description = "BO Admin"))
50       )
51     )
52   )
53   @ApiResponses(
54     value = Array(new ApiResponse(code = HttpCodes.OK, message = "Ok", response = classOf[SecureHashResponse]))
55   )
56   @ApiImplicitParams(
57     value = Array(
58       new ApiImplicitParam(
59         value = "body",
60         paramType = "body",
61         dataType = "org.make.api.technical.security.CreateSecureHashRequest"
62       )
63     )
64   )
65   def adminCreateSecureHash: Route
66 
67   @Path(value = "/security/secure-hash")
68   @ApiOperation(value = "validate-secure-hash", httpMethod = "POST", code = HttpCodes.NoContent)
69   @ApiResponses(value = Array(new ApiResponse(code = HttpCodes.NoContent, message = "No Content")))
70   @ApiImplicitParams(
71     value = Array(
72       new ApiImplicitParam(
73         value = "body",
74         paramType = "body",
75         dataType = "org.make.api.technical.security.ValidateSecureHashRequest"
76       )
77     )
78   )
79   def validateSecureHash: Route
80 
81   def routes: Route = adminCreateSecureHash ~ validateSecureHash
82 }
83 
84 trait SecurityApiComponent {
85   def securityApi: SecurityApi
86 }
87 
88 trait DefaultSecurityApiComponent extends SecurityApiComponent with MakeAuthenticationDirectives {
89   this: MakeDirectivesDependencies
90     with ActorSystemComponent
91     with QuestionServiceComponent
92     with OperationServiceComponent =>
93 
94   override lazy val securityApi: SecurityApi = new DefaultSecurityApi
95 
96   class DefaultSecurityApi extends SecurityApi {
97 
98     override def adminCreateSecureHash: Route =
99       post {
100         path("admin" / "security" / "secure-hash") {
101           makeOperation("CreateSecureHash") { _ =>
102             makeOAuth2 { userAuth: AuthInfo[UserRights] =>
103               requireAdminRole(userAuth.user) {
104                 decodeRequest {
105                   entity(as[CreateSecureHashRequest]) { request: CreateSecureHashRequest =>
106                     complete(
107                       SecureHashResponse(hash =
108                         SecurityHelper.createSecureHash(request.value, securityConfiguration.secureHashSalt)
109                       )
110                     )
111                   }
112                 }
113               }
114             }
115           }
116         }
117       }
118 
119     override def validateSecureHash: Route =
120       post {
121         path("security" / "secure-hash") {
122           makeOperation("ValidateSecureHash", EndpointType.Public) { _ =>
123             decodeRequest {
124               entity(as[ValidateSecureHashRequest]) { request: ValidateSecureHashRequest =>
125                 if (SecurityHelper
126                       .validateSecureHash(request.hash, request.value, securityConfiguration.secureHashSalt)) {
127                   complete(StatusCodes.NoContent)
128                 } else {
129                   complete(StatusCodes.BadRequest)
130                 }
131               }
132             }
133           }
134         }
135       }
136   }
137 }
138 
139 final case class CreateSecureHashRequest(value: String)
140 
141 object CreateSecureHashRequest {
142   implicit val decoder: Decoder[CreateSecureHashRequest] = deriveDecoder[CreateSecureHashRequest]
143 }
144 
145 final case class ValidateSecureHashRequest(hash: String, value: String)
146 
147 object ValidateSecureHashRequest {
148   implicit val decoder: Decoder[ValidateSecureHashRequest] = deriveDecoder[ValidateSecureHashRequest]
149 }
150 
151 final case class SecureHashResponse(hash: String)
152 
153 object SecureHashResponse {
154   implicit val encoder: Encoder[SecureHashResponse] = deriveEncoder[SecureHashResponse]
155   implicit val decoder: Decoder[SecureHashResponse] = deriveDecoder[SecureHashResponse]
156 }