handlers.go

package main

// HTTP handlers module
//
// Copyright (c) 2023 - Valentin Kuznetsov <vkuznet@gmail.com>
//
import (
	"embed"
	"encoding/json"
	"errors"
	"fmt"
	"html/template"
	"io"
	"log"
	"net/http"
	"strings"
	"time"

	authz "github.com/CHESSComputing/golib/authz"
	srvConfig "github.com/CHESSComputing/golib/config"
	server "github.com/CHESSComputing/golib/server"
	services "github.com/CHESSComputing/golib/services"
	utils "github.com/CHESSComputing/golib/utils"
	"github.com/gin-gonic/gin"
	oauth2 "github.com/go-oauth2/oauth2/v4"
	credentials "gopkg.in/jcmturner/gokrb5.v7/credentials"
)

type DocsParams struct {
	Login string `json:"login" uri:"login" binding:"required"`
}
type UserParams struct {
	Login    string `json:"login" uri:"login" binding:"required"`
	Password string `json:"password" uri:"password" binding:"required"`
}

// content is our static web server content.
//
//go:embed static
var StaticFs embed.FS

// helper function to handle http server errors
func handleError(c *gin.Context, msg string, err error) {
	w := c.Writer
	log.Printf("ERROR: %v\n", err)
	tmpl := server.MakeTmpl(StaticFs, "Error")
	tmpl["Message"] = strings.ToTitle(msg)
	page := server.TmplPage(StaticFs, "error.tmpl", tmpl)
	w.WriteHeader(http.StatusOK)
	w.Write([]byte(page))
}

// helper function to get valid token
func validToken(c *gin.Context, user, scope string) (oauth2.GrantType, *oauth2.TokenGenerateRequest, error) {
	var gt oauth2.GrantType
	// for grant type we must use AuthorizationCode which force creation of access token with valid scope
	//     gt = oauth2.AuthorizationCode
	gt = oauth2.ClientCredentials
	//     gt = oauth2.PasswordCredentials
	duration := srvConfig.Config.Authz.TokenExpires
	tgr := &oauth2.TokenGenerateRequest{
		ClientID:       srvConfig.Config.Authz.ClientID,
		ClientSecret:   srvConfig.Config.Authz.ClientSecret,
		UserID:         user,
		Scope:          scope,
		AccessTokenExp: time.Duration(duration),
		Request:        c.Request,
	}
	return gt, tgr, nil
}

// helper function to generate valid token map
func tokenMap(user, scope, kind, app string, expires int64) (authz.TokenMap, error) {
	auser := authz.AuthUser{
		Name:  user,
		Scope: scope,
		Kind:  "client_credentials",
		App:   "Authz service",
	}
	if kind != "" {
		auser.Kind = kind
	}
	duration := srvConfig.Config.Authz.TokenExpires
	if expires != 0 {
		auser.Expires = expires
	}
	if duration == 0 {
		auser.Expires = 7200
	}
	// service_user is set when we perform inter-service requests between FOXDEN servies
	if user != "" && user != "service_user" && kind != "trusted_client" {
		// only check user attributes if user name is provided
		if fuser, err := _foxdenUser.Get(user); err == nil {
			auser.Btrs = fuser.Btrs
			auser.Groups = fuser.Groups
			auser.Scopes = fuser.Scopes
		}
	}
	return auser.TokenMap()
}

// AttributesHandler provides access to GET /attrs end-point
func AttributesHandler(c *gin.Context) {
	r := c.Request
	user := r.URL.Query().Get("user")
	if fuser, err := _foxdenUser.Get(user); err == nil {
		c.JSON(http.StatusOK, fuser)
		return
	}
	rec := services.Response("Authz", http.StatusBadRequest, services.CredentialsError, errors.New("No user attributes"))
	c.JSON(http.StatusBadRequest, rec)
}

// TokenHandler provides access to GET /oauth/token end-point
func TokenHandler(c *gin.Context) {

	r := c.Request
	scope := r.URL.Query().Get("scope")
	user := r.URL.Query().Get("user")
	clientId := r.URL.Query().Get("client_id")
	clientSecret := r.URL.Query().Get("client_secret")
	if user == "" && clientId == srvConfig.Config.Authz.ClientID && clientSecret == srvConfig.Config.Authz.ClientSecret {
		user = "service_user"
	}
	tmap, err := tokenMap(user, scope, "client_credentials", "Authz", 0)
	if Verbose > 2 {
		log.Println("token map", tmap, err)
	}
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	c.JSON(http.StatusOK, tmap)
}

// LoginHandler handlers Login requests
func LoginHandler(w http.ResponseWriter, r *http.Request) {
	// func LoginHandler(c *gin.Context) {
	//     w := c.Writer
	//     r := c.Request
	if r.Method != "GET" {
		w.WriteHeader(http.StatusMethodNotAllowed)
		return
	}
	tmpl := server.MakeTmpl(StaticFs, "Login")
	tmpl["Title"] = "Login"
	tmpl["Base"] = srvConfig.Config.Frontend.WebServer.Base
	tmpl["ServerInfo"] = srvConfig.Info()
	top := server.TmplPage(StaticFs, "header.tmpl", tmpl)
	bottom := server.TmplPage(StaticFs, "footer.tmpl", tmpl)
	tmpl["StartTime"] = time.Now().Unix()
	page := server.TmplPage(StaticFs, "login.tmpl", tmpl)
	w.WriteHeader(http.StatusOK)
	w.Write([]byte(top + page + bottom))
}

// ClientAuthHandler provides kerberos authentication for CLI requests
// func ClientAuthHandler(w http.ResponseWriter, r *http.Request) {
func ClientAuthHandler(c *gin.Context) {
	r := c.Request

	// in testmode we do not go through authorization process and issue token right away
	if srvConfig.Config.Authz.TestMode {
		tmap, err := tokenMap("testuser", "read+write", "testmode", "Authz", 3600)
		if err != nil {
			rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, err)
			c.JSON(http.StatusBadRequest, rec)
			return
		}
		c.JSON(http.StatusOK, tmap)
		return
	}

	var rec authz.Kerberos
	defer r.Body.Close()
	data, err := io.ReadAll(r.Body)
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.ReaderError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	err = json.Unmarshal(data, &rec)
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.UnmarshalError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	creds, err := rec.Credentials()
	if err != nil || creds.Expired() {
		rec := services.Response("Authz", http.StatusBadRequest, services.CredentialsError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	if creds.Expired() {
		rec := services.Response("Authz", http.StatusBadRequest, services.CredentialsError, errors.New("Expired token"))
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	if creds.UserName() != rec.User {
		rec := services.Response("Authz", http.StatusBadRequest, services.CredentialsError, errors.New("User credentials error"))
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	/*
		// check LDAP group for this user
		if srvConfig.Config.Authz.CheckLDAP {
			entry, err := ldapCache.Search(srvConfig.Config.LDAP.Login, srvConfig.Config.LDAP.Password, rec.User)
			if err != nil {
				msg := fmt.Sprintf("No LDAP entry, error: %v", err)
				rec := services.Response("Authz", http.StatusBadRequest, services.LDAPSearchError, errors.New(msg))
				c.JSON(http.StatusBadRequest, rec)
				return
			}
			group := "" // by default all users will have right access privilege
			if strings.Contains(rec.Scope, "write") {
				group = srvConfig.Config.AccessRules.WriteGroup
			} else if strings.Contains(rec.Scope, "delete") {
				group = srvConfig.Config.AccessRules.AdminGroup
			}
			if group != "" && !entry.Belong(group) {
				msg := fmt.Sprintf("User %s with scope %s is not allowed", rec.User, rec.Scope)
				rec := services.Response("Authz", http.StatusBadRequest, services.LDAPGroupError, errors.New(msg))
				c.JSON(http.StatusBadRequest, rec)
				return
			}
		}
	*/
	// check user privileges
	if fuser, err := _foxdenUser.Get(rec.User); err == nil {
		group := "" // by default all users will have right access privilege
		if strings.Contains(rec.Scope, "write") {
			group = srvConfig.Config.AccessRules.WriteGroup
		} else if strings.Contains(rec.Scope, "delete") {
			group = srvConfig.Config.AccessRules.AdminGroup
		}
		if group != "" && !utils.InList(group, fuser.Groups) {
			msg := fmt.Sprintf("User %s with scope %s is not allowed, user btrs=%+v groups=%+v", rec.User, rec.Scope, fuser.Btrs, fuser.Groups)
			rec := services.Response("Authz", http.StatusBadRequest, services.LDAPGroupError, errors.New(msg))
			c.JSON(http.StatusBadRequest, rec)
			return
		}
	} else {
		msg := fmt.Sprintf("No foxden user found, error: %v", err)
		rec := services.Response("Authz", http.StatusBadRequest, services.LDAPSearchError, errors.New(msg))
		c.JSON(http.StatusBadRequest, rec)
		return
	}

	tmap, err := tokenMap(rec.User, rec.Scope, "kerberos", "Authz", rec.Expires)
	if Verbose > 2 {
		log.Println("token map", tmap, err)
	}
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	c.JSON(http.StatusOK, tmap)
}

// TrustedClientInfo represents trusted client system info to be send to /trusted_client
// end-point via POST HTTP request
type TrustedClientInfo struct {
	User string   `json:"user"`
	IPs  []string `json:"ips"`
	MACs []string `json:"macs"`
}

// TrustedClientHandler perform trusted client check
func TrustedClientHandler(c *gin.Context) {
	r := c.Request
	data, err := io.ReadAll(r.Body)
	defer r.Body.Close()
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.ParametersError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	var rec TrustedClientInfo
	err = json.Unmarshal(data, &rec)
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.UnmarshalError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	// using provided trusted client info validate that it is accepted by Authz server based on its TrustedUsers configuration
	found := false
	for _, tuser := range srvConfig.Config.TrustedUsers {
		for _, ip := range rec.IPs {
			for _, mac := range rec.MACs {
				if tuser.User == rec.User && tuser.IP == ip && tuser.MAC == mac {
					found = true
					break
				}
			}
		}
	}
	if !found {
		msg := "trusted client info does not match"
		rec := services.Response("Authz", http.StatusBadRequest, services.AuthError, errors.New(msg))
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	resp := services.Response("Authz", http.StatusOK, services.OK, nil)
	c.JSON(http.StatusBadRequest, resp)
}

// TrustedHandler handles request for trusted client
func TrustedHandler(c *gin.Context) {
	r := c.Request
	if Verbose > 0 {
		log.Println("Trusted HTTP request from", getIP(r))
	}
	edata, err := io.ReadAll(r.Body)
	defer r.Body.Close()
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	var t utils.TrustedClient
	salt := authz.ReadSecret(srvConfig.Config.Encryption.Secret)
	err = t.Decrypt([]byte(edata), salt)
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}

	// check if user/IP/Mac are matched with our configuration
	var foundIP, foundMAC string
	for _, tuser := range srvConfig.Config.TrustedUsers {
		if tuser.User == t.User {
			for _, ip := range t.IPs {
				if tuser.IP == ip {
					foundIP = ip
					for _, mac := range t.MACs {
						if tuser.MAC == mac.Address {
							foundMAC = mac.Address
						}
					}
				}
			}
		}
	}
	if foundIP == "" || foundMAC == "" {
		log.Printf("ERROR: client %+v not found in trusted list", t)
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, errors.New("user not found in trusted list"))
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	clientIP := getIP(r)
	// check if request comes from remote host and skip check for localhost
	if clientIP != "::1" && foundIP != clientIP {
		log.Printf("ERROR: client IP %s does not match with HTTP IP %s", foundIP, clientIP)
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, errors.New("client IP does not match with HTTP one"))
		c.JSON(http.StatusBadRequest, rec)
		return
	}

	tmap, err := tokenMap(t.User, "read+write", "trusted_client", "Authz", 0)
	if Verbose > 2 {
		log.Println("token map", tmap, err)
	}
	if err != nil {
		rec := services.Response("Authz", http.StatusBadRequest, services.TokenError, err)
		c.JSON(http.StatusBadRequest, rec)
		return
	}
	c.JSON(http.StatusOK, tmap)
}

// KAuthHandler provides KAuth authentication to our app
// func KAuthHandler(w http.ResponseWriter, r *http.Request) {
func KAuthHandler(c *gin.Context) {
	// get http request/writer
	w := c.Writer
	r := c.Request

	// First, we need to get the value of the `code` query param
	err := r.ParseForm()
	if err != nil {
		log.Printf("could not parse http form, error %v\n", err)
		w.WriteHeader(http.StatusBadRequest)
	}
	name := r.FormValue("name")
	password := r.FormValue("password")
	var creds *credentials.Credentials
	if name != "" && password != "" {
		creds, err = kuser(name, password)
		if err != nil {
			msg := "wrong user credentials"
			handleError(c, msg, err)
			return
		}
	} else {
		msg := "user/password is empty"
		handleError(c, msg, err)
		return
	}
	if creds == nil {
		msg := "unable to obtain user credentials"
		handleError(c, msg, err)
		return
	}

	expiration := time.Now().Add(24 * time.Hour)
	msg := fmt.Sprintf("%s-%v", creds.UserName(), creds.Authenticated())
	//     byteArray := encrypt([]byte(msg), Config.StoreSecret)
	//     n := bytes.IndexByte(byteArray, 0)
	//     s := string(byteArray[:n])
	cookie := http.Cookie{Name: "auth-session", Value: msg, Expires: expiration}
	http.SetCookie(w, &cookie)
	//     w.WriteHeader(http.StatusFound)

	// get user access token
	tmap, err := tokenMap(name, "read", "kerberos", "Authz", 0)
	if Verbose > 2 {
		log.Println("token map", tmap, err)
	}
	tmpl := server.MakeTmpl(StaticFs, "Login")
	tmpl["Base"] = srvConfig.Config.Authz.WebServer.Base
	header := server.TmplPage(StaticFs, "header.tmpl", tmpl)
	footer := server.TmplPage(StaticFs, "footer.tmpl", tmpl)
	if tmap.AccessToken != "" {
		token := tmap.AccessToken
		tmpl["AccessToken"] = token
		claims, err := authz.TokenClaims(token, srvConfig.Config.Authz.ClientID)
		if err != nil {
			log.Println("ERROR", err)
			tmpl["Content"] = err.Error()
			content := server.TmplPage(StaticFs, "error.tmpl", tmpl)
			c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(header+content+footer))
			return
		}
		data, err := json.MarshalIndent(claims, "", "   ")
		if err == nil {
			tmpl["TokenData"] = string(data)
		} else {
			log.Println("ERROR", err)
		}
		content := server.TmplPage(StaticFs, "token.tmpl", tmpl)
		tmpl["Content"] = template.HTML(content)
	}
	content := server.TmplPage(StaticFs, "success.tmpl", tmpl)
	c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(header+content+footer))
}