ripple-api/app/v1/token.go

package v1

import (
	"crypto/md5"
	"crypto/sha256"
	"database/sql"
	"encoding/json"
	"errors"
	"fmt"
	"strconv"
	"time"

	"github.com/jmoiron/sqlx"

	"golang.org/x/crypto/bcrypt"
	"zxq.co/ripple/rippleapi/common"
	"zxq.co/ripple/rippleapi/limit"
	"zxq.co/ripple/schiavolib"
)

type tokenNewInData struct {
	// either username or userid must be given in the request.
	// if none is given, the request is trashed.
	Username    string `json:"username"`
	UserID      int    `json:"id"`
	Password    string `json:"password"`
	Privileges  int    `json:"privileges"`
	Description string `json:"description"`
}

type tokenNewResponse struct {
	common.ResponseBase
	Username   string `json:"username"`
	ID         int    `json:"id"`
	Privileges int    `json:"privileges"`
	Token      string `json:"token,omitempty"`
	Banned     bool   `json:"banned"`
}

// TokenNewPOST is the handler for POST /token/new.
func TokenNewPOST(md common.MethodData) common.CodeMessager {
	var r tokenNewResponse
	data := tokenNewInData{}
	err := md.Unmarshal(&data)
	if err != nil {
		return ErrBadJSON
	}

	md.Doggo.Incr("tokens.new", nil, 1)

	var miss []string
	if data.Username == "" && data.UserID == 0 {
		miss = append(miss, "username|id")
	}
	if data.Password == "" {
		miss = append(miss, "password")
	}
	if len(miss) != 0 {
		return ErrMissingField(miss...)
	}

	var q *sql.Row
	const base = "SELECT id, username, privileges, password_md5, password_version, privileges FROM users "
	if data.UserID != 0 {
		q = md.DB.QueryRow(base+"WHERE id = ? LIMIT 1", data.UserID)
	} else {
		q = md.DB.QueryRow(base+"WHERE username = ? LIMIT 1", common.SafeUsername(data.Username))
	}

	var (
		rank          int
		pw            string
		pwVersion     int
		privilegesRaw uint64
	)

	err = q.Scan(&r.ID, &r.Username, &rank, &pw, &pwVersion, &privilegesRaw)
	switch {
	case err == sql.ErrNoRows:
		return common.SimpleResponse(404, "No user with that username/id was found.")
	case err != nil:
		md.Err(err)
		return Err500
	}
	privileges := common.UserPrivileges(privilegesRaw)

	if !limit.NonBlockingRequest(fmt.Sprintf("loginattempt:%d:%s", r.ID, md.ClientIP()), 5) {
		return common.SimpleResponse(429, "You've made too many login attempts. Try again later.")
	}

	if pwVersion == 1 {
		return common.SimpleResponse(418, "That user still has a password in version 1. Unfortunately, in order for the API to check for the password to be OK, the user has to first log in through the website.")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(pw), []byte(fmt.Sprintf("%x", md5.Sum([]byte(data.Password))))); err != nil {
		if err == bcrypt.ErrMismatchedHashAndPassword {
			return common.SimpleResponse(403, "That password doesn't match!")
		}
		md.Err(err)
		return Err500
	}
	const want = (common.UserPrivilegePublic | common.UserPrivilegeNormal)
	if (privileges & want) != want {
		r.Code = 402
		r.Message = "That user is banned."
		r.Banned = true
		return r
	}
	r.Privileges = int(common.Privileges(data.Privileges).CanOnly(privileges))

	var (
		tokenStr string
		tokenMD5 string
	)
	for {
		tokenStr = common.RandomString(32)
		tokenMD5 = fmt.Sprintf("%x", md5.Sum([]byte(tokenStr)))
		r.Token = tokenStr
		var id int

		err := md.DB.QueryRow("SELECT id FROM tokens WHERE token=? LIMIT 1", tokenMD5).Scan(&id)
		if err == sql.ErrNoRows {
			break
		}
		if err != nil {
			md.Err(err)
			return Err500
		}
	}
	_, err = md.DB.Exec("INSERT INTO tokens(user, privileges, description, token, private, last_updated) VALUES (?, ?, ?, ?, '0', ?)",
		r.ID, r.Privileges, data.Description, tokenMD5, time.Now().Unix())
	if err != nil {
		md.Err(err)
		return Err500
	}

	r.Code = 200
	return r
}

// TokenSelfDeletePOST deletes the token the user is connecting with.
func TokenSelfDeletePOST(md common.MethodData) common.CodeMessager {
	if md.ID() == 0 {
		return common.SimpleResponse(400, "How should we delete your token if you haven't even given us one?!")
	}
	var err error
	if md.IsBearer() {
		_, err = md.DB.Exec("DELETE FROM osin_access WHERE access_token = ? LIMIT 1",
			fmt.Sprintf("%x", sha256.Sum256([]byte(md.User.Value))))
	} else {
		_, err = md.DB.Exec("DELETE FROM tokens WHERE token = ? LIMIT 1",
			fmt.Sprintf("%x", md5.Sum([]byte(md.User.Value))))
	}
	if err != nil {
		md.Err(err)
		return Err500
	}
	return common.SimpleResponse(200, "Bye!")
}

type token struct {
	ID          int                  `json:"id"`
	Privileges  uint64               `json:"privileges"`
	Description string               `json:"description"`
	LastUpdated common.UnixTimestamp `json:"last_updated"`
}
type tokenResponse struct {
	common.ResponseBase
	Tokens []token `json:"tokens"`
}

// TokenGET retrieves a list listing all the user's public tokens.
func TokenGET(md common.MethodData) common.CodeMessager {
	rows, err := md.DB.Query("SELECT id, privileges, description, last_updated FROM tokens WHERE user = ? AND private = '0' "+common.Paginate(md.Query("p"), md.Query("l"), 50), md.ID())
	if err != nil {
		return Err500
	}
	var r tokenResponse
	for rows.Next() {
		var t token
		err = rows.Scan(&t.ID, &t.Privileges, &t.Description, &t.LastUpdated)
		if err != nil {
			md.Err(err)
			continue
		}
		r.Tokens = append(r.Tokens, t)
	}
	r.Code = 200
	return r
}

type oauthClient struct {
	ID      string `json:"id"`
	Name    string `json:"name"`
	OwnerID int    `json:"owner_id"`
	Avatar  string `json:"avatar"`
}

// Scan scans the extra in the mysql table into Name, OwnerID and Avatar.
func (o *oauthClient) Scan(src interface{}) error {
	var s []byte
	switch x := src.(type) {
	case string:
		s = []byte(x)
	case []byte:
		s = x
	default:
		return errors.New("Can't scan non-string")
	}

	var vals [3]string
	err := json.Unmarshal(s, &vals)
	if err != nil {
		return err
	}

	o.Name = vals[0]
	o.OwnerID, _ = strconv.Atoi(vals[1])
	o.Avatar = vals[2]

	return nil
}

type bearerToken struct {
	Client     oauthClient       `json:"client"`
	Scope      string            `json:"scope"`
	Privileges common.Privileges `json:"privileges"`
	Created    time.Time         `json:"created"`
}

type tokenSingleResponse struct {
	common.ResponseBase
	token
}

type bearerTokenSingleResponse struct {
	common.ResponseBase
	bearerToken
}

// TokenSelfGET retrieves information about the token the user is connecting with.
func TokenSelfGET(md common.MethodData) common.CodeMessager {
	if md.ID() == 0 {
		return common.SimpleResponse(404, "How are we supposed to find the token you're using if you ain't even using one?!")
	}
	if md.IsBearer() {
		return getBearerToken(md)
	}
	var r tokenSingleResponse
	// md.User.ID = token id, userid would have been md.User.UserID. what a clusterfuck
	err := md.DB.QueryRow("SELECT id, privileges, description, last_updated FROM tokens WHERE id = ?", md.User.ID).Scan(
		&r.ID, &r.Privileges, &r.Description, &r.LastUpdated,
	)
	if err != nil {
		md.Err(err)
		return Err500
	}
	r.Code = 200
	return r
}

func getBearerToken(md common.MethodData) common.CodeMessager {
	var b bearerTokenSingleResponse
	err := md.DB.
		QueryRow(`
			SELECT t.scope, t.created_at, c.id, c.extra
			FROM osin_access t INNER JOIN osin_client c
			WHERE t.access_token = ?
		`, fmt.Sprintf("%x", sha256.Sum256([]byte(md.User.Value)))).Scan(
		&b.Scope, &b.Created, &b.Client.ID, &b.Client,
	)
	if err != nil {
		md.Err(err)
		return Err500
	}
	b.Code = 200
	b.Privileges = md.User.TokenPrivileges
	return b
}

// TokenFixPrivilegesPOST fixes the privileges on the token of the given user,
// or of all the users if no user is given.
func TokenFixPrivilegesPOST(md common.MethodData) common.CodeMessager {
	id := common.Int(md.Query("id"))
	if md.Query("id") == "self" {
		id = md.ID()
	}
	go fixPrivileges(id, md.DB)
	return common.SimpleResponse(200, "Privilege fixing started!")
}

func fixPrivileges(user int, db *sqlx.DB) {
	var wc string
	var params = make([]interface{}, 0, 1)
	if user != 0 {
		// dirty, but who gives a shit
		wc = "WHERE user = ?"
		params = append(params, user)
	}
	rows, err := db.Query(`
SELECT
	tokens.id, tokens.privileges, users.privileges
FROM tokens
LEFT JOIN users ON users.id = tokens.user
`+wc, params...)
	if err != nil {
		fmt.Println(err)
		schiavo.Bunker.Send(err.Error())
		return
	}
	for rows.Next() {
		var (
			id            int
			privsRaw      uint64
			privs         common.Privileges
			newPrivs      common.Privileges
			privilegesRaw uint64
		)
		err := rows.Scan(&id, &privsRaw, &privilegesRaw)
		if err != nil {
			fmt.Println(err)
			continue
		}
		privileges := common.UserPrivileges(privilegesRaw)
		privs = common.Privileges(privsRaw)
		newPrivs = privs.CanOnly(privileges)
		if newPrivs != privs {
			_, err := db.Exec("UPDATE tokens SET privileges = ? WHERE id = ? LIMIT 1", uint64(newPrivs), id)
			if err != nil {
				fmt.Println(err)
				schiavo.Bunker.Send(err.Error())
				continue
			}
		}
	}
}