package account import ( "context" "crypto/ed25519" "embed" _ "embed" "io/fs" "net/http" "strings" "github.com/rs/cors" "git.lumeweb.com/LumeWeb/portal/api/swagger" "git.lumeweb.com/LumeWeb/portal/api/router" "git.lumeweb.com/LumeWeb/portal/config" "go.uber.org/zap" "github.com/julienschmidt/httprouter" "git.lumeweb.com/LumeWeb/portal/account" "git.lumeweb.com/LumeWeb/portal/api/middleware" "git.lumeweb.com/LumeWeb/portal/api/registry" "go.sia.tech/jape" "go.uber.org/fx" ) //go:embed swagger.yaml var swagSpec []byte //go:embed all:app/build/client var appFs embed.FS var ( _ registry.API = (*AccountAPI)(nil) _ router.RoutableAPI = (*AccountAPI)(nil) ) type AccountAPI struct { config *config.Manager accounts *account.AccountServiceDefault identity ed25519.PrivateKey logger *zap.Logger } type AccountAPIParams struct { fx.In Config *config.Manager Accounts *account.AccountServiceDefault Identity ed25519.PrivateKey Logger *zap.Logger } func NewS5(params AccountAPIParams) AccountApiResult { api := &AccountAPI{ config: params.Config, accounts: params.Accounts, identity: params.Identity, logger: params.Logger, } return AccountApiResult{ API: api, AccountAPI: api, } } var Module = fx.Module("s5_api", fx.Provide(NewS5), ) type AccountApiResult struct { fx.Out API registry.API `group:"api"` AccountAPI *AccountAPI } func (a AccountAPI) Name() string { return "account" } func (a *AccountAPI) Init() error { return nil } func (a AccountAPI) Start(ctx context.Context) error { return nil } func (a AccountAPI) Stop(ctx context.Context) error { return nil } func (a AccountAPI) login(jc jape.Context) { var request LoginRequest if jc.Decode(&request) != nil { return } exists, _, err := a.accounts.EmailExists(request.Email) if !exists { _ = jc.Error(account.NewAccountError(account.ErrKeyInvalidLogin, nil), http.StatusUnauthorized) if err != nil { a.logger.Error("failed to check if email exists", zap.Error(err)) } return } jwt, user, err := a.accounts.LoginPassword(request.Email, request.Password, jc.Request.RemoteAddr) if err != nil || user == nil { _ = jc.Error(account.NewAccountError(account.ErrKeyInvalidLogin, err), http.StatusUnauthorized) if err != nil { a.logger.Error("failed to login", zap.Error(err)) } return } account.SetAuthCookie(jc, jwt, "") account.SendJWT(jc, jwt) jc.Encode(&LoginResponse{ Token: jwt, Otp: user.OTPEnabled && user.OTPVerified, }) } func (a AccountAPI) register(jc jape.Context) { var request RegisterRequest if jc.Decode(&request) != nil { return } if len(request.FirstName) == 0 || len(request.LastName) == 0 { _ = jc.Error(account.NewAccountError(account.ErrKeyAccountCreationFailed, nil), http.StatusBadRequest) return } user, err := a.accounts.CreateAccount(request.Email, request.Password, false) if err != nil { _ = jc.Error(err, http.StatusUnauthorized) a.logger.Error("failed to update account name", zap.Error(err)) return } err = a.accounts.UpdateAccountName(user.ID, request.FirstName, request.LastName) if err != nil { _ = jc.Error(account.NewAccountError(account.ErrKeyAccountCreationFailed, err), http.StatusBadRequest) a.logger.Error("failed to update account name", zap.Error(err)) return } } func (a AccountAPI) verifyEmail(jc jape.Context) { var request VerifyEmailRequest if jc.Decode(&request) != nil { return } err := a.accounts.VerifyEmail(request.Email, request.Token) if jc.Check("failed to verify email", err) != nil { return } } func (a AccountAPI) otpGenerate(jc jape.Context) { user := middleware.GetUserFromContext(jc.Request.Context()) otp, err := a.accounts.OTPGenerate(user) if jc.Check("failed to generate otp", err) != nil { return } jc.Encode(&OTPGenerateResponse{ OTP: otp, }) } func (a AccountAPI) otpVerify(jc jape.Context) { user := middleware.GetUserFromContext(jc.Request.Context()) var request OTPVerifyRequest if jc.Decode(&request) != nil { return } err := a.accounts.OTPEnable(user, request.OTP) if jc.Check("failed to verify otp", err) != nil { return } } func (a AccountAPI) otpValidate(jc jape.Context) { user := middleware.GetUserFromContext(jc.Request.Context()) var request OTPValidateRequest if jc.Decode(&request) != nil { return } jwt, err := a.accounts.LoginOTP(user, request.OTP) if jc.Check("failed to validate otp", err) != nil { return } account.SetAuthCookie(jc, jwt, "") account.SendJWT(jc, jwt) jc.Encode(&LoginResponse{ Token: jwt, Otp: false, }) } func (a AccountAPI) otpDisable(jc jape.Context) { user := middleware.GetUserFromContext(jc.Request.Context()) var request OTPDisableRequest if jc.Decode(&request) != nil { return } valid, _, err := a.accounts.ValidLoginByUserID(user, request.Password) if !valid { _ = jc.Error(account.NewAccountError(account.ErrKeyInvalidLogin, nil), http.StatusUnauthorized) return } err = a.accounts.OTPDisable(user) if jc.Check("failed to disable otp", err) != nil { return } } func (a AccountAPI) passwordResetRequest(jc jape.Context) { var request PasswordResetRequest if jc.Decode(&request) != nil { return } exists, user, err := a.accounts.EmailExists(request.Email) if jc.Check("invalid request", err) != nil || !exists { return } err = a.accounts.SendPasswordReset(user) if jc.Check("failed to request password reset", err) != nil { return } jc.ResponseWriter.WriteHeader(http.StatusOK) } func (a AccountAPI) passwordResetConfirm(jc jape.Context) { var request PasswordResetVerifyRequest if jc.Decode(&request) != nil { return } exists, _, err := a.accounts.EmailExists(request.Email) if jc.Check("invalid request", err) != nil || !exists { return } err = a.accounts.ResetPassword(request.Email, request.Password, request.Token) if jc.Check("failed to reset password", err) != nil { return } jc.ResponseWriter.WriteHeader(http.StatusOK) } func (a AccountAPI) ping(jc jape.Context) { token := middleware.GetAuthTokenFromContext(jc.Request.Context()) account.EchoAuthCookie(jc, a.Name()) jc.Encode(&PongResponse{ Ping: "pong", Token: token, }) } func (a AccountAPI) accountInfo(jc jape.Context) { user := middleware.GetUserFromContext(jc.Request.Context()) _, acct, _ := a.accounts.AccountExists(user) jc.Encode(&AccountInfoResponse{ ID: acct.ID, Email: acct.Email, FirstName: acct.FirstName, LastName: acct.LastName, }) } func (a AccountAPI) logout(c jape.Context) { account.ClearAuthCookie(c, "") } func (a AccountAPI) uploadLimit(c jape.Context) { c.Encode(&UploadLimitResponse{ Limit: a.config.Config().Core.PostUploadLimit, }) } func (a AccountAPI) updateEmail(c jape.Context) { user := middleware.GetUserFromContext(c.Request.Context()) var request UpdateEmailRequest if c.Decode(&request) != nil { return } err := a.accounts.UpdateAccountEmail(user, request.Email, request.Password) if c.Check("failed to update email", err) != nil { return } } func (a *AccountAPI) Routes() (*httprouter.Router, error) { loginAuthMw2fa := authMiddleware(middleware.AuthMiddlewareOptions{ Identity: a.identity, Accounts: a.accounts, Config: a.config, Purpose: account.JWTPurpose2FA, EmptyAllowed: true, }) authMw := authMiddleware(middleware.AuthMiddlewareOptions{ Identity: a.identity, Accounts: a.accounts, Config: a.config, Purpose: account.JWTPurposeNone, }) pingAuthMw := authMiddleware(middleware.AuthMiddlewareOptions{ Identity: a.identity, Accounts: a.accounts, Config: a.config, Purpose: account.JWTPurposeLogin, }) appFiles, _ := fs.Sub(appFs, "app/build/client") appServ := http.FileServer(http.FS(appFiles)) appHandler := func(c jape.Context) { appServ.ServeHTTP(c.ResponseWriter, c.Request) } appServer := middleware.ApplyMiddlewares(appHandler, middleware.ProxyMiddleware) swaggerRoutes, err := swagger.Swagger(swagSpec, map[string]jape.Handler{}) if err != nil { return nil, err } swaggerJape := jape.Mux(swaggerRoutes) getApiJape := jape.Mux(map[string]jape.Handler{ "GET /api/auth/otp/generate": middleware.ApplyMiddlewares(a.otpGenerate, authMw, middleware.ProxyMiddleware), "GET /api/account": middleware.ApplyMiddlewares(a.accountInfo, authMw, middleware.ProxyMiddleware), "GET /api/upload-limit": middleware.ApplyMiddlewares(a.uploadLimit, middleware.ProxyMiddleware), }) getHandler := func(c jape.Context) { if strings.HasPrefix(c.Request.URL.Path, "/api") { getApiJape.ServeHTTP(c.ResponseWriter, c.Request) return } if strings.HasPrefix(c.Request.URL.Path, "/swagger") { swaggerJape.ServeHTTP(c.ResponseWriter, c.Request) return } if !strings.HasPrefix(c.Request.URL.Path, "/assets") && c.Request.URL.Path != "favicon.ico" && c.Request.URL.Path != "/" && !strings.HasSuffix(c.Request.URL.Path, ".html") { c.Request.URL.Path = "/" } appServer(c) } corsMw := cors.New(cors.Options{ AllowedOrigins: []string{"*." + a.config.Config().Core.Domain}, AllowedMethods: []string{"*"}, }) routes := map[string]jape.Handler{ // Auth "POST /api/auth/ping": middleware.ApplyMiddlewares(a.ping, corsMw.Handler, pingAuthMw, middleware.ProxyMiddleware), "POST /api/auth/login": middleware.ApplyMiddlewares(a.login, corsMw.Handler, loginAuthMw2fa, middleware.ProxyMiddleware), "POST /api/auth/register": middleware.ApplyMiddlewares(a.register, corsMw.Handler, middleware.ProxyMiddleware), "POST /api/auth/otp/validate": middleware.ApplyMiddlewares(a.otpValidate, corsMw.Handler, authMw, middleware.ProxyMiddleware), "POST /api/auth/logout": middleware.ApplyMiddlewares(a.logout, corsMw.Handler, authMw, middleware.ProxyMiddleware), // Account "POST /api/account/verify-email": middleware.ApplyMiddlewares(a.verifyEmail, corsMw.Handler, middleware.ProxyMiddleware), "POST /api/account/otp/verify": middleware.ApplyMiddlewares(a.otpVerify, corsMw.Handler, authMw, middleware.ProxyMiddleware), "POST /api/account/otp/disable": middleware.ApplyMiddlewares(a.otpDisable, corsMw.Handler, authMw, middleware.ProxyMiddleware), "POST /api/account/password-reset/request": middleware.ApplyMiddlewares(a.passwordResetRequest, corsMw.Handler, middleware.ProxyMiddleware), "POST /api/account/password-reset/confirm": middleware.ApplyMiddlewares(a.passwordResetConfirm, corsMw.Handler, middleware.ProxyMiddleware), "POST /api/account/update-email": middleware.ApplyMiddlewares(a.updateEmail, corsMw.Handler, authMw, middleware.ProxyMiddleware), "GET /*path": middleware.ApplyMiddlewares(getHandler, corsMw.Handler), } return jape.Mux(routes), nil } func (a AccountAPI) Can(w http.ResponseWriter, r *http.Request) bool { return false } func (a AccountAPI) Handle(w http.ResponseWriter, r *http.Request) { } func (a *AccountAPI) Domain() string { return router.BuildSubdomain(a, a.config) } func (a AccountAPI) AuthTokenName() string { return account.AUTH_COOKIE_NAME }