chore: migrate authifier into codebase (#658)

Co-authored-by: izzy <me@insrt.uk>
Signed-off-by: Zomatree <me@zomatree.live>
Signed-off-by: izzy <me@insrt.uk>

crates/delta/src/routes/mfa/create_ticket.rs

@@ -0,0 +1,157 @@
+//! Create a new MFA ticket or validate an existing one.
+//! PUT /mfa/ticket
+use revolt_result::{Result, create_error};
+use revolt_database::{Account, Database, MFATicket, UnvalidatedTicket};
+use revolt_models::v0;
+use rocket::serde::json::Json;
+use rocket::State;
+
+
+/// # Create MFA ticket
+///
+/// Create a new MFA ticket or validate an existing one.
+#[openapi(tag = "MFA")]
+#[put("/ticket", data = "<data>")]
+pub async fn create_ticket(
+    db: &State<Database>,
+    account: Option<Account>,
+    existing_ticket: Option<UnvalidatedTicket>,
+    data: Json<v0::MFAResponse>,
+) -> Result<Json<v0::MFATicket>> {
+    // Find the relevant account
+    let mut account = match (account, existing_ticket) {
+        (Some(_), Some(_)) => return Err(create_error!(OperationFailed)),
+        (Some(account), _) => account,
+        (_, Some(ticket)) => {
+            db.delete_ticket(&ticket.id).await?;
+            db.fetch_account(&ticket.account_id).await?
+        }
+        _ => return Err(create_error!(InvalidToken)),
+    };
+
+    // Validate the MFA response
+    account
+        .consume_mfa_response(db, data.into_inner(), None)
+        .await?;
+
+    // Create a new ticket for this account
+    let ticket = MFATicket::new(account.id, true);
+    ticket.save(db).await?;
+    Ok(Json(ticket.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::Totp;
+    use rocket::http::{Header, Status};
+    use revolt_models::v0;
+    use revolt_result::{Error, ErrorType};
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (_, session, _) = harness.new_user().await;
+
+        let res = harness.client
+            .put("/auth/mfa/ticket")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .body(
+                json!({
+                    "password": "password_insecure"
+                })
+                .to_string(),
+            )
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert!(res.into_json::<v0::MFATicket>().await.unwrap().validated);
+    }
+
+    #[rocket::async_test]
+    async fn success_totp() {
+        let harness = TestHarness::new().await;
+        let (mut account, session, _) = harness.new_user().await;
+
+        account.mfa.totp_token = Totp::Enabled {
+            secret: "secret".to_string(),
+        };
+        account.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .put("/auth/mfa/ticket")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .body(
+                json!({
+                    "totp_code": Totp::Enabled {
+                        secret: "secret".to_string(),
+                    }.generate_code().unwrap()
+                })
+                .to_string(),
+            )
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert!(res.into_json::<v0::MFATicket>().await.is_some());
+    }
+
+    #[rocket::async_test]
+    async fn failure_totp() {
+        let harness = TestHarness::new().await;
+        let (mut account, session, _) = harness.new_user().await;
+
+        account.mfa.totp_token = Totp::Enabled {
+            secret: "secret".to_string(),
+        };
+        account.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .put("/auth/mfa/ticket")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .body(
+                json!({
+                    "totp_code": "000000"
+                })
+                .to_string(),
+            )
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Unauthorized);
+        assert!(matches!(
+            res.into_json::<Error>().await.unwrap().error_type,
+            ErrorType::InvalidToken,
+        ));
+    }
+
+    #[rocket::async_test]
+    async fn failure_no_totp() {
+        let harness = TestHarness::new().await;
+        let (mut account, session, _) = harness.new_user().await;
+
+        account.mfa.totp_token = Totp::Enabled {
+            secret: "secret".to_string(),
+        };
+        account.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .put("/auth/mfa/ticket")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .body(
+                json!({
+                    "password": "this is the wrong mfa method"
+                })
+                .to_string(),
+            )
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::BadRequest);
+        assert!(matches!(
+            res.into_json::<Error>().await.unwrap().error_type,
+            ErrorType::DisallowedMFAMethod,
+        ));
+    }
+}

crates/delta/src/routes/mfa/fetch_recovery.rs

@@ -0,0 +1,45 @@
+//! Fetch recovery codes for an account.
+//! POST /mfa/recovery
+use rocket::serde::json::Json;
+use revolt_database::{Account, ValidatedTicket};
+use revolt_result::Result;
+
+/// # Fetch Recovery Codes
+///
+/// Fetch recovery codes for an account.
+#[openapi(tag = "MFA")]
+#[post("/recovery")]
+pub async fn fetch_recovery(
+    account: Account,
+    _ticket: ValidatedTicket,
+) -> Result<Json<Vec<String>>> {
+    Ok(Json(account.mfa.recovery_codes))
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::MFATicket;
+    use rocket::http::{ContentType, Header, Status};
+
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (account, session, _) = harness.new_user().await;
+
+        let ticket = MFATicket::new(account.id, true);
+        ticket.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .post("/auth/mfa/recovery")
+            .header(Header::new("X-Session-Token", session.token))
+            .header(Header::new("X-MFA-Ticket", ticket.token))
+            .header(ContentType::JSON)
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert!(res.into_json::<Vec<String>>().await.unwrap().is_empty());
+    }
+}

crates/delta/src/routes/mfa/fetch_status.rs

@@ -0,0 +1,37 @@
+//! Fetch MFA status of an account.
+//! GET /mfa
+use revolt_database::Account;
+use revolt_result::Result;
+use revolt_models::v0;
+use rocket::serde::json::Json;
+
+/// # MFA Status
+///
+/// Fetch MFA status of an account.
+#[openapi(tag = "MFA")]
+#[get("/")]
+pub async fn fetch_status(account: Account) -> Result<Json<v0::MultiFactorStatus>> {
+    Ok(Json(account.mfa.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use rocket::http::{Header, Status};
+    use revolt_models::v0;
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (_, session, _) = harness.new_user().await;
+
+        let res = harness.client
+            .get("/auth/mfa")
+            .header(Header::new("X-Session-Token", session.token))
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert!(res.into_json::<v0::MultiFactorStatus>().await.is_some());
+    }
+}

crates/delta/src/routes/mfa/generate_recovery.rs

@@ -0,0 +1,66 @@
+//! Re-generate recovery codes for an account.
+//! PATCH /mfa/recovery
+use revolt_database::{Account, ValidatedTicket, Database};
+use revolt_result::Result;
+use rocket::serde::json::Json;
+use rocket::State;
+
+/// # Generate Recovery Codes
+///
+/// Re-generate recovery codes for an account.
+#[openapi(tag = "MFA")]
+#[patch("/recovery")]
+pub async fn generate_recovery(
+    db: &State<Database>,
+    mut account: Account,
+    _ticket: ValidatedTicket,
+) -> Result<Json<Vec<String>>> {
+    // Generate new codes
+    account.mfa.generate_recovery_codes();
+
+    // Save account model
+    account.save(db).await?;
+
+    // Return them to the user
+    Ok(Json(account.mfa.recovery_codes))
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::MFATicket;
+    use rocket::http::{ContentType, Header, Status};
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (account, session, _) = harness.new_user().await;
+
+        let ticket1 = MFATicket::new(account.id.to_string(), true);
+        ticket1.save(&harness.db).await.unwrap();
+
+        let ticket2 = MFATicket::new(account.id, true);
+        ticket2.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .patch("/auth/mfa/recovery")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .header(Header::new("X-MFA-Ticket", ticket1.token))
+            .header(ContentType::JSON)
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert!(res.into_json::<Vec<String>>().await.is_some());
+
+        let res = harness.client
+            .post("/auth/mfa/recovery")
+            .header(Header::new("X-Session-Token", session.token))
+            .header(Header::new("X-MFA-Ticket", ticket2.token))
+            .header(ContentType::JSON)
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert_eq!(res.into_json::<Vec<String>>().await.unwrap().len(), 10);
+    }
+}

crates/delta/src/routes/mfa/get_mfa_methods.rs

@@ -0,0 +1,71 @@
+//! Fetch available MFA methods.
+//! GET /mfa/methods
+use revolt_database::Account;
+use revolt_models::v0;
+use rocket::serde::json::Json;
+
+/// # Get MFA Methods
+///
+/// Fetch available MFA methods.
+#[openapi(tag = "MFA")]
+#[get("/methods")]
+pub async fn get_mfa_methods(account: Account) -> Json<Vec<v0::MFAMethod>> {
+    Json(
+        account
+            .mfa
+            .get_methods()
+            .into_iter()
+            .map(Into::into)
+            .collect(),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::Totp;
+    use rocket::http::{Header, Status};
+    use revolt_models::v0;
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (_, session, _) = harness.new_user().await;
+
+        let res = harness.client
+            .get("/auth/mfa/methods")
+            .header(Header::new("X-Session-Token", session.token))
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert_eq!(
+            res.into_json::<Vec<v0::MFAMethod>>().await.unwrap(),
+            vec![v0::MFAMethod::Password]
+        );
+    }
+
+    #[rocket::async_test]
+    async fn success_has_recovery_and_totp() {
+        let harness = TestHarness::new().await;
+        let (mut account, session, _) = harness.new_user().await;
+
+        account.mfa.totp_token = Totp::Enabled {
+            secret: "some".to_string(),
+        };
+        account.mfa.generate_recovery_codes();
+        account.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .get("/auth/mfa/methods")
+            .header(Header::new("X-Session-Token", session.token))
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        assert_eq!(
+            res.into_json::<Vec<v0::MFAMethod>>().await.unwrap(),
+            vec![v0::MFAMethod::Totp, v0::MFAMethod::Recovery]
+        );
+    }
+}

crates/delta/src/routes/mfa/mod.rs

@@ -0,0 +1,24 @@
+use revolt_rocket_okapi::revolt_okapi::openapi3::OpenApi;
+use rocket::Route;
+
+pub mod create_ticket;
+pub mod fetch_recovery;
+pub mod fetch_status;
+pub mod generate_recovery;
+pub mod get_mfa_methods;
+pub mod totp_disable;
+pub mod totp_enable;
+pub mod totp_generate_secret;
+
+pub fn routes() -> (Vec<Route>, OpenApi) {
+    openapi_get_routes_spec![
+        create_ticket::create_ticket,
+        fetch_status::fetch_status,
+        fetch_recovery::fetch_recovery,
+        generate_recovery::generate_recovery,
+        get_mfa_methods::get_mfa_methods,
+        totp_disable::totp_disable,
+        totp_enable::totp_enable,
+        totp_generate_secret::totp_generate_secret,
+    ]
+}

crates/delta/src/routes/mfa/totp_disable.rs

@@ -0,0 +1,49 @@
+//! Disable TOTP 2FA.
+//! DELETE /mfa/totp
+use revolt_database::{Database, Account, ValidatedTicket, Totp};
+use revolt_result::Result;
+use rocket::State;
+use rocket_empty::EmptyResponse;
+
+/// # Disable TOTP 2FA
+///
+/// Disable TOTP 2FA for an account.
+#[openapi(tag = "MFA")]
+#[delete("/totp")]
+pub async fn totp_disable(
+    db: &State<Database>,
+    mut account: Account,
+    _ticket: ValidatedTicket,
+) -> Result<EmptyResponse> {
+    // Disable TOTP
+    account.mfa.totp_token = Totp::Disabled;
+
+    // Save model to database
+    account.save(db).await.map(|_| EmptyResponse)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::MFATicket;
+    use rocket::http::{Header, Status};
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (account, session, _) = harness.new_user().await;
+
+        let ticket = MFATicket::new(account.id, true);
+        ticket.save(&harness.db).await.unwrap();
+
+
+        let res = harness.client
+            .delete("/auth/mfa/totp")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .header(Header::new("X-MFA-Ticket", ticket.token))
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::NoContent);
+    }
+}

crates/delta/src/routes/mfa/totp_enable.rs

@@ -0,0 +1,102 @@
+//! Generate a new secret for TOTP.
+//! POST /mfa/totp
+use revolt_database::{Database, Account};
+use revolt_models::v0;
+use revolt_result::Result;
+use rocket::serde::json::Json;
+use rocket::State;
+use rocket_empty::EmptyResponse;
+
+/// # Enable TOTP 2FA
+///
+/// Generate a new secret for TOTP.
+#[openapi(tag = "MFA")]
+#[put("/totp", data = "<data>")]
+pub async fn totp_enable(
+    db: &State<Database>,
+    mut account: Account,
+    data: Json<v0::MFAResponse>,
+) -> Result<EmptyResponse> {
+    // Enable TOTP 2FA
+    account.mfa.enable_totp(data.into_inner())?;
+
+    // Save model to database
+    account.save(db).await.map(|_| EmptyResponse)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::{MFATicket, Totp};
+    use rocket::http::{ContentType, Header, Status};
+    use revolt_models::v0;
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (account, session, _) = harness.new_user().await;
+
+        let ticket = MFATicket::new(account.id.to_string(), true);
+        ticket.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .post("/auth/mfa/totp")
+            .header(Header::new("X-Session-Token", session.token.clone()))
+            .header(Header::new("X-MFA-Ticket", ticket.token))
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+
+        let secret = res.into_json::<v0::ResponseTotpSecret>().await.unwrap().secret;
+
+        let code = Totp::Enabled { secret }.generate_code().unwrap();
+
+        let res = harness.client
+            .put("/auth/mfa/totp")
+            .header(Header::new("X-Session-Token", session.token))
+            .header(ContentType::JSON)
+            .body(json!({ "totp_code": code }).to_string())
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::NoContent);
+
+        let res = harness.client
+            .post("/auth/session/login")
+            .header(ContentType::JSON)
+            .body(
+                json!({
+                    "email": account.email.clone(),
+                    "password": "password_insecure"
+                })
+                .to_string(),
+            )
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+        let response = res.into_json::<v0::ResponseLogin>().await.unwrap();
+
+        if let v0::ResponseLogin::MFA { ticket, .. } = response {
+            let res = harness.client
+                .post("/auth/session/login")
+                .header(ContentType::JSON)
+                .body(
+                    json!({
+                        "mfa_ticket": ticket,
+                        "mfa_response": {
+                            "totp_code": code
+                        }
+                    })
+                    .to_string(),
+                )
+                .dispatch()
+                .await;
+
+            assert_eq!(res.status(), Status::Ok);
+        } else {
+            unreachable!("Did not receive MFA challenge!");
+        }
+    }
+}

crates/delta/src/routes/mfa/totp_generate_secret.rs

@@ -0,0 +1,59 @@
+//! Generate a new secret for TOTP.
+//! POST /mfa/totp
+use revolt_result::Result;
+use revolt_models::v0;
+use revolt_database::{Database, Account, ValidatedTicket};
+use rocket::serde::json::Json;
+use rocket::State;
+
+
+/// # Generate TOTP Secret
+///
+/// Generate a new secret for TOTP.
+#[openapi(tag = "MFA")]
+#[post("/totp")]
+pub async fn totp_generate_secret(
+    db: &State<Database>,
+    mut account: Account,
+    _ticket: ValidatedTicket,
+) -> Result<Json<v0::ResponseTotpSecret>> {
+    // Generate a new secret
+    let secret = account.mfa.generate_new_totp_secret()?;
+
+    // Save model to database
+    account.save(db).await?;
+
+    // Send secret to user
+    Ok(Json(v0::ResponseTotpSecret { secret }))
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{rocket, util::test::TestHarness};
+    use revolt_database::{MFATicket, Totp};
+    use rocket::http::{Header, Status};
+    use revolt_models::v0;
+
+    #[rocket::async_test]
+    async fn success() {
+        let harness = TestHarness::new().await;
+        let (account, session, _) = harness.new_user().await;
+
+        let ticket = MFATicket::new(account.id.to_string(), true);
+        ticket.save(&harness.db).await.unwrap();
+
+        let res = harness.client
+            .post("/auth/mfa/totp")
+            .header(Header::new("X-Session-Token", session.token))
+            .header(Header::new("X-MFA-Ticket", ticket.token))
+            .dispatch()
+            .await;
+
+        assert_eq!(res.status(), Status::Ok);
+
+        let secret = res.into_json::<v0::ResponseTotpSecret>().await.unwrap().secret;
+
+        let account = harness.db.fetch_account(&account.id).await.unwrap();
+        assert_eq!(account.mfa.totp_token, Totp::Pending { secret });
+    }
+}