model.go

package backend

import (
	"context"
	"errors"
	"fmt"
	"os"
	"strings"

	ldaputil "git.autistici.org/ai3/go-common/ldap"
	"gopkg.in/ldap.v2"

	"git.autistici.org/ai3/accountserver"
)

// Generic interface to LDAP - allows us to stub out the LDAP client while
// testing.
type ldapConn interface {
	Search(context.Context, *ldap.SearchRequest) (*ldap.SearchResult, error)
	Add(context.Context, *ldap.AddRequest) error
	Modify(context.Context, *ldap.ModifyRequest) error
	Close()
}

// backend is the interface to an LDAP-backed user database.
//
// We keep a set of LDAP queries for each resource type, each having a
// "resource" query to return a specific resource belonging to a user,
// and a "presence" query that checks for existence of a resource for
// all users.
type backend struct {
	conn                ldapConn
	userQuery           *queryConfig
	userResourceQueries []*queryConfig
	resources           *resourceRegistry
}

// backendTX holds the business logic (that runs within a single
// transaction).
type backendTX struct {
	*ldapTX
	backend *backend
}

const ldapPoolSize = 20

func (b *backend) NewTransaction() (accountserver.TX, error) {
	return &backendTX{
		ldapTX:  newLDAPTX(b.conn),
		backend: b,
	}, nil
}

// NewLDAPBackend initializes an LDAPBackend object with the given LDAP
// connection pool.
func NewLDAPBackend(uri, bindDN, bindPw, base string) (accountserver.Backend, error) {
	pool, err := ldaputil.NewConnectionPool(uri, bindDN, bindPw, ldapPoolSize)
	if err != nil {
		return nil, err
	}
	return newLDAPBackendWithConn(pool, base)
}

func newLDAPBackendWithConn(conn ldapConn, base string) (*backend, error) {
	rsrc := newResourceRegistry()
	rsrc.register(accountserver.ResourceTypeEmail, &emailResourceHandler{baseDN: base})
	rsrc.register(accountserver.ResourceTypeMailingList, &mailingListResourceHandler{baseDN: base})
	rsrc.register(accountserver.ResourceTypeDAV, &webdavResourceHandler{baseDN: base})
	rsrc.register(accountserver.ResourceTypeWebsite, &websiteResourceHandler{baseDN: base})
	rsrc.register(accountserver.ResourceTypeDomain, &domainResourceHandler{baseDN: base})
	rsrc.register(accountserver.ResourceTypeDatabase, &databaseResourceHandler{baseDN: base})

	return &backend{
		conn: conn,
		userQuery: mustCompileQueryConfig(&queryConfig{
			Base:  "uid=${user},ou=People," + base,
			Scope: "base",
		}),
		userResourceQueries: []*queryConfig{
			// Find all resources that are children of the main uid object.
			mustCompileQueryConfig(&queryConfig{
				Base:  "uid=${user},ou=People," + base,
				Scope: "sub",
			}),
			// Find mailing lists, which are nested under a different root.
			mustCompileQueryConfig(&queryConfig{
				Base:   "ou=Lists," + base,
				Filter: "(&(objectClass=mailingList)(listOwner=${user}))",
				Scope:  "one",
			}),
		},
		resources: rsrc,
	}, nil
}

func replaceVars(s string, vars map[string]string) string {
	return os.Expand(s, func(k string) string {
		return ldap.EscapeFilter(vars[k])
	})
}

// queryConfig holds the parameters for a single LDAP query.
type queryConfig struct {
	Base        string
	Filter      string
	Scope       string
	parsedScope int
}

func (q *queryConfig) validate() error {
	if q.Base == "" {
		return errors.New("empty search base")
	}
	// An empty filter is equivalent to objectClass=*.
	if q.Filter == "" {
		q.Filter = "(objectClass=*)"
	}
	q.parsedScope = ldap.ScopeWholeSubtree
	if q.Scope != "" {
		s, err := ldaputil.ParseScope(q.Scope)
		if err != nil {
			return err
		}
		q.parsedScope = s
	}
	return nil
}

func (q *queryConfig) searchRequest(vars map[string]string, attrs []string) *ldap.SearchRequest {
	return ldap.NewSearchRequest(
		replaceVars(q.Base, vars),
		q.parsedScope,
		ldap.NeverDerefAliases,
		0,
		0,
		false,
		replaceVars(q.Filter, vars),
		attrs,
		nil,
	)
}

func mustCompileQueryConfig(q *queryConfig) *queryConfig {
	if err := q.validate(); err != nil {
		panic(err)
	}
	return q
}

func s2b(s string) bool {
	switch s {
	case "yes", "y", "on", "enabled", "true":
		return true
	default:
		return false
	}
}

func b2s(b bool) string {
	if b {
		return "yes"
	}
	return "no"
}

// Convert a string to a []string with a single item, or nil if the
// string is empty. Useful for optional single-valued LDAP attributes.
func s2l(s string) []string {
	if s == "" {
		return nil
	}
	return []string{s}
}

func newUser(entry *ldap.Entry) (*accountserver.User, error) {
	user := &accountserver.User{
		Name:              entry.GetAttributeValue("uid"),
		Lang:              entry.GetAttributeValue("preferredLanguage"),
		Has2FA:            (entry.GetAttributeValue("totpSecret") != ""),
		HasEncryptionKeys: (len(entry.GetAttributeValues("storageEncryptionKey")) > 0),
		//PasswordRecoveryHint: entry.GetAttributeValue("recoverQuestion"),
	}
	if user.Lang == "" {
		user.Lang = "en"
	}
	return user, nil
}

func getUserDN(user *accountserver.User) string {
	// TODO: fix this
	return fmt.Sprintf("uid=%s,ou=People,", user.Name)
}

// GetUser returns a user.
func (tx *backendTX) GetUser(ctx context.Context, username string) (*accountserver.User, error) {
	// First of all, find the main user object, and just that one.
	vars := map[string]string{"user": username}
	result, err := tx.search(ctx, tx.backend.userQuery.searchRequest(vars, nil))
	if err != nil {
		if ldap.IsErrorWithCode(err, ldap.LDAPResultNoSuchObject) {
			return nil, nil
		}
		return nil, err
	}

	user, err := newUser(result.Entries[0])
	if err != nil {
		return nil, err
	}

	// Now run the resource queries, and accumulate results on the User
	// object we just created.
	// TODO: parallelize.
	// TODO: add support for non-LDAP resource queries.
	for _, query := range tx.backend.userResourceQueries {
		result, err = tx.search(ctx, query.searchRequest(vars, nil))
		if err != nil {
			continue
		}

		for _, entry := range result.Entries {
			// Some user-level attributes are actually stored on the email
			// object, a shortcoming of the legacy A/I database model. Set
			// them on the main User object.
			if isObjectClass(entry, "virtualMailUser") {
				user.PasswordRecoveryHint = entry.GetAttributeValue("recoverQuestion")
				user.AppSpecificPasswords = getASPInfo(decodeAppSpecificPasswords(entry.GetAttributeValues("appSpecificPassword")))
			}

			// Parse the resource and add it to the User.
			if r, err := tx.backend.resources.FromLDAP(entry); err == nil {
				user.Resources = append(user.Resources, r)
			}
		}
	}

	groupWebResourcesByHomedir(user.Resources)

	return user, nil
}

func singleAttributeQuery(dn, attribute string) *ldap.SearchRequest {
	return ldap.NewSearchRequest(
		dn,
		ldap.ScopeBaseObject,
		ldap.NeverDerefAliases,
		0,
		0,
		false,
		"(objectClass=*)",
		[]string{attribute},
		nil,
	)
}

func (tx *backendTX) readAttributeValues(ctx context.Context, dn, attribute string) []string {
	req := singleAttributeQuery(dn, attribute)
	result, err := tx.search(ctx, req)
	if err != nil {
		return nil
	}
	if len(result.Entries) < 1 {
		return nil
	}
	return result.Entries[0].GetAttributeValues(attribute)
}

func (tx *backendTX) SetUserPassword(ctx context.Context, user *accountserver.User, encryptedPassword string) error {
	tx.setAttr(getUserDN(user), "userPassword", encryptedPassword)
	return nil
}

func (tx *backendTX) GetUserEncryptionKeys(ctx context.Context, user *accountserver.User) ([]*accountserver.UserEncryptionKey, error) {
	rawKeys := tx.readAttributeValues(ctx, getUserDN(user), "storageEncryptionKey")
	return accountserver.DecodeUserEncryptionKeys(rawKeys), nil
}

func (tx *backendTX) SetUserEncryptionKeys(ctx context.Context, user *accountserver.User, keys []*accountserver.UserEncryptionKey) error {
	encKeys := accountserver.EncodeUserEncryptionKeys(keys)
	tx.setAttr(getUserDN(user), "storageEncryptionKey", encKeys...)
	return nil
}

func (tx *backendTX) SetUserEncryptionPublicKey(ctx context.Context, user *accountserver.User, pub []byte) error {
	tx.setAttr(getUserDN(user), "storageEncryptionPublicKey", string(pub))
	return nil
}

func excludeASPFromList(asps []*appSpecificPassword, id string) []*appSpecificPassword {
	var out []*appSpecificPassword
	for _, asp := range asps {
		if asp.ID != id {
			out = append(out, asp)
		}
	}
	return out
}

func (tx *backendTX) SetApplicationSpecificPassword(ctx context.Context, user *accountserver.User, info *accountserver.AppSpecificPasswordInfo, encryptedPassword string) error {
	emailRsrc := user.GetSingleResourceByType(accountserver.ResourceTypeEmail)
	if emailRsrc == nil {
		return errors.New("no email resource")
	}
	emailDN, _ := tx.backend.resources.GetDN(emailRsrc.ID)

	// Obtain the full list of ASPs from the backend and replace/append the new one.
	asps := decodeAppSpecificPasswords(tx.readAttributeValues(ctx, emailDN, "appSpecificPassword"))
	asps = append(excludeASPFromList(asps, info.ID), newAppSpecificPassword(*info, encryptedPassword))
	outASPs := encodeAppSpecificPasswords(asps)

	tx.setAttr(emailDN, "appSpecificPassword", outASPs...)
	return nil
}

func (tx *backendTX) DeleteApplicationSpecificPassword(ctx context.Context, user *accountserver.User, id string) error {
	emailRsrc := user.GetSingleResourceByType(accountserver.ResourceTypeEmail)
	if emailRsrc == nil {
		return errors.New("no email resource")
	}
	emailDN, _ := tx.backend.resources.GetDN(emailRsrc.ID)

	asps := decodeAppSpecificPasswords(tx.readAttributeValues(ctx, emailDN, "appSpecificPassword"))
	asps = excludeASPFromList(asps, id)
	outASPs := encodeAppSpecificPasswords(asps)

	tx.setAttr(emailDN, "appSpecificPassword", outASPs...)
	return nil
}

func (tx *backendTX) SetUserTOTPSecret(ctx context.Context, user *accountserver.User, secret string) error {
	tx.setAttr(getUserDN(user), "totpSecret", secret)
	return nil
}

func (tx *backendTX) DeleteUserTOTPSecret(ctx context.Context, user *accountserver.User) error {
	tx.setAttr(getUserDN(user), "totpSecret")
	return nil
}

func (tx *backendTX) SetResourcePassword(ctx context.Context, r *accountserver.Resource, encryptedPassword string) error {
	dn, _ := tx.backend.resources.GetDN(r.ID)
	tx.setAttr(dn, "userPassword", encryptedPassword)
	return nil
}

func (tx *backendTX) hasResource(ctx context.Context, resourceType, resourceName string) (bool, error) {
	query, err := tx.backend.resources.SearchQuery(resourceType)
	if err != nil {
		return false, err
	}

	// Make a quick LDAP search that only fetches the DN attribute.
	result, err := tx.search(ctx, query.searchRequest(map[string]string{
		"resource": resourceName,
		"type":     resourceType,
	}, []string{"dn"}))
	if err != nil {
		if ldap.IsErrorWithCode(err, ldap.LDAPResultNoSuchObject) {
			return false, nil
		}
		return false, err
	}
	if len(result.Entries) == 0 {
		return false, nil
	}
	return true, nil
}

// HasAnyResource returns true if any of the specified resources exists.
func (tx *backendTX) HasAnyResource(ctx context.Context, resourceIDs []accountserver.FindResourceRequest) (bool, error) {
	for _, req := range resourceIDs {
		has, err := tx.hasResource(ctx, req.Type, req.Name)
		if err != nil || has {
			return has, err
		}
	}
	return false, nil
}

// GetResource returns a ResourceWrapper, as part of a read-modify-update transaction.
func (tx *backendTX) GetResource(ctx context.Context, rsrcID accountserver.ResourceID) (*accountserver.Resource, error) {
	// From the resource ID we can obtain the DN, and fetch it
	// straight from LDAP without even doing a real search.
	dn, err := tx.backend.resources.GetDN(rsrcID)
	if err != nil {
		return nil, err
	}

	// This is just a 'point' search.
	req := ldap.NewSearchRequest(
		dn,
		ldap.ScopeBaseObject,
		ldap.NeverDerefAliases,
		0,
		0,
		false,
		"(objectClass=*)",
		nil,
		nil,
	)

	result, err := tx.search(ctx, req)
	if err != nil {
		if ldap.IsErrorWithCode(err, ldap.LDAPResultNoSuchObject) {
			return nil, nil
		}
		return nil, err
	}

	// We know the resource type so we don't have to guess.
	return tx.backend.resources.FromLDAPWithType(rsrcID.Type(), result.Entries[0])
}

// UpdateResource updates a LDAP-backed resource that was obtained by a previous GetResource call.
func (tx *backendTX) UpdateResource(ctx context.Context, r *accountserver.Resource) error {
	dn, err := tx.backend.resources.GetDN(r.ID)
	if err != nil {
		return err
	}

	// We can simply dump all attribute/value pairs and let the
	// code in ldapTX do the work of finding the differences.
	for _, attr := range tx.backend.resources.ToLDAP(r) {
		tx.setAttr(dn, attr.Type, attr.Vals...)
	}

	return nil
}

func isObjectClass(entry *ldap.Entry, class string) bool {
	classes := entry.GetAttributeValues("objectClass")
	for _, c := range classes {
		if c == class {
			return true
		}
	}
	return false
}

var siteRoot = "/home/users/investici.org/"

// The hosting directory for a website is the path component immediately after
// siteRoot. This works also for sites with nested documentRoots.
func getHostingDir(path string) string {
	path = strings.TrimPrefix(path, siteRoot)
	if i := strings.Index(path, "/"); i > 0 {
		return path[:i]
	}
	return path
}

// This is a very specific function meant to address a peculiar characteristic
// of the A/I legacy data model, where DAV accounts and websites do not have an
// explicit relation.
func groupWebResourcesByHomedir(resources []*accountserver.Resource) {
	// Set the group name to be the 'hostingDir' for sites and DAV
	// accounts. Keep a reference of websites by ID so we can later fix the
	// group for databases too, via their ParentID.
	webs := make(map[string]*accountserver.Resource)
	for _, r := range resources {
		switch r.ID.Type() {
		case accountserver.ResourceTypeWebsite, accountserver.ResourceTypeDomain:
			r.Group = getHostingDir(r.Website.DocumentRoot)
			webs[r.ID.String()] = r
		case accountserver.ResourceTypeDAV:
			r.Group = getHostingDir(r.DAV.Homedir)
		}
	}
	// Fix databases in a second pass.
	for _, r := range resources {
		if r.ID.Type() == accountserver.ResourceTypeDatabase && !r.ParentID.Empty() {
			r.Group = webs[r.ParentID.String()].Group
		}
	}
}