vw_small

two_factor.rs (24585B)

---

 use crate::{
     api::EmptyResult,
     db::{
         schema::{totp, webauthn, webauthn_auth, webauthn_reg},
         DbConn, FromDb,
     },
     error::Error,
 };
 use serde::ser::{Serialize, SerializeStruct, Serializer};
 use serde_json::de;
 use tokio::task;
 use webauthn_rs::prelude::{
     CredentialID, SecurityKey, SecurityKeyAuthentication, SecurityKeyRegistration,
 };
 db_object! {
     #[derive(Insertable, Queryable)]
     #[diesel(table_name = webauthn)]
     pub struct WebAuthn {
         credential_id: String,
         pub user_uuid: String,
         pub id: i64,
         pub name: String,
         security_key: String,
     }
     #[derive(Insertable, Queryable)]
     #[diesel(table_name = webauthn_auth)]
     pub struct WebAuthnAuth {
         pub user_uuid: String,
         data: String,
     }
     #[derive(Insertable, Queryable)]
     #[diesel(table_name = webauthn_reg)]
     pub struct WebAuthnReg {
         pub user_uuid: String,
         data: String,
     }
     #[derive(Insertable, Queryable)]
     #[diesel(table_name = totp)]
     pub struct Totp {
         user_uuid: String,
         pub token: String,
         last_used: i64,
     }
 }
 impl WebAuthn {
     pub fn new(
         user_uuid: String,
         id: i64,
         name: String,
         security_key: &SecurityKey,
     ) -> Result<Self, Error> {
         Ok(Self {
             credential_id: security_key.cred_id().to_string(),
             user_uuid,
             id,
             name,
             security_key: serde_json::to_string(security_key)?,
         })
     }
     pub fn credential_id(&self) -> Result<CredentialID, Error> {
         CredentialID::try_from(self.credential_id.as_str())
             .map_err(|()| Error::from(String::from("invalid credential ID")))
     }
     pub fn security_key(&self) -> Result<SecurityKey, Error> {
         serde_json::from_str(self.security_key.as_str()).map_err(Error::from)
     }
     pub fn set_security_key(&mut self, security_key: &SecurityKey) -> Result<(), Error> {
         self.security_key = serde_json::to_string(security_key)?;
         Ok(())
     }
 }
 impl WebAuthnAuth {
     pub fn new(
         user_uuid: String,
         security_key_auth: &SecurityKeyAuthentication,
     ) -> Result<Self, Error> {
         Ok(Self {
             user_uuid,
             data: serde_json::to_string(security_key_auth)?,
         })
     }
     pub fn security_key_auth(&self) -> Result<SecurityKeyAuthentication, Error> {
         serde_json::from_str(&self.data).map_err(Error::from)
     }
 }
 impl WebAuthnReg {
     pub fn new(
         user_uuid: String,
         security_key_reg: &SecurityKeyRegistration,
     ) -> Result<Self, Error> {
         Ok(Self {
             user_uuid,
             data: serde_json::to_string(security_key_reg)?,
         })
     }
     pub fn security_key_reg(&self) -> Result<SecurityKeyRegistration, Error> {
         serde_json::from_str(&self.data).map_err(Error::from)
     }
 }
 #[derive(Queryable)]
 pub struct WebAuthnInfo {
     id: i64,
     name: String,
 }
 impl Serialize for WebAuthnInfo {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where
         S: Serializer,
     {
         let mut s = serializer.serialize_struct("WebAuthnInfo", 3)?;
         s.serialize_field("id", &self.id)?;
         s.serialize_field("name", self.name.as_str())?;
         s.serialize_field("migrated", &false)?;
         s.end()
     }
 }
 /// Represents a WebAuthn challenge.
 pub enum WebAuthnChallenge {
     Auth(WebAuthnAuth),
     Reg(WebAuthnReg),
 }
 
 #[derive(Clone, Copy)]
 pub enum TwoFactorType {
     Totp = 0,
     WebAuthn = 7,
 }
 impl From<TwoFactorType> for i32 {
     fn from(value: TwoFactorType) -> Self {
         match value {
             TwoFactorType::Totp => 0i32,
             TwoFactorType::WebAuthn => 7i32,
         }
     }
 }
 impl TryFrom<i32> for TwoFactorType {
     type Error = Error;
     fn try_from(value: i32) -> Result<Self, Self::Error> {
         match value {
             0i32 => Ok(Self::Totp),
             7i32 => Ok(Self::WebAuthn),
             _ => Err(Error::from(String::from(
                 "i32 is not a valid TwoFactorType",
             ))),
         }
     }
 }
 impl Serialize for TwoFactorType {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where
         S: Serializer,
     {
         let mut s = serializer.serialize_struct("TwoFactorType", 3)?;
         s.serialize_field("enabled", &true)?;
         s.serialize_field("type", &i32::from(*self))?;
         s.serialize_field("object", "twoFactorProvider")?;
         s.end()
     }
 }
 impl Totp {
     pub const fn new(user_uuid: String, token: String) -> Self {
         Self {
             user_uuid,
             token,
             last_used: 0,
         }
     }
     pub fn get_last_used(&self) -> u64 {
         u64::try_from(self.last_used).expect("underflow")
     }
     pub fn set_last_used(&mut self, last_used: u64) {
         self.last_used = i64::try_from(last_used).expect("overflow");
     }
 }
 impl TwoFactorType {
     #[allow(clippy::clone_on_ref_ptr, clippy::shadow_unrelated)]
     pub async fn delete_all_by_user(user_uuid: &str, conn: &DbConn) -> EmptyResult {
         use diesel::prelude::{Connection, ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             con.transaction(|con| {
                 diesel::delete(webauthn::table)
                     .filter(webauthn::user_uuid.eq(user_uuid))
                     .execute(con)
                     .and_then(|_| {
                         diesel::delete(totp::table)
                             .filter(totp::user_uuid.eq(user_uuid))
                             .execute(con)
                             .map(|_| ())
                     })
                     .map_err(result::Error::into)
             })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn delete_by_user(self, user_uuid: &str, conn: &DbConn) -> EmptyResult {
         use diesel::prelude::{ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             match self {
                 Self::Totp => diesel::delete(totp::table)
                     .filter(totp::user_uuid.eq(user_uuid))
                     .execute(con),
                 Self::WebAuthn => diesel::delete(webauthn::table)
                     .filter(webauthn::user_uuid.eq(user_uuid))
                     .execute(con),
             }
             .map(|_| ())
             .map_err(result::Error::into)
         })
     }
     #[allow(clippy::clone_on_ref_ptr, clippy::shadow_unrelated)]
     pub async fn has_twofactor(user_uuid: &str, conn: &DbConn) -> Result<bool, Error> {
         use diesel::prelude::{Connection, ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             con.transaction(|con| {
                 webauthn::table
                     .count()
                     .filter(webauthn::user_uuid.eq(user_uuid))
                     .get_result::<i64>(con)
                     .map_err(result::Error::into)
                     .and_then(|count| {
                         if count == 0 {
                             totp::table
                                 .count()
                                 .filter(totp::user_uuid.eq(user_uuid))
                                 .get_result::<i64>(con)
                                 .map_err(result::Error::into)
                                 .map(|count| count > 0)
                         } else {
                             Ok(true)
                         }
                     })
             })
         })
     }
     /// The `bool` represents if WebAuthn is enabled.
     /// The `Option` represents if TOTP is enabled; and if so, contains the secret token.
     #[allow(clippy::clone_on_ref_ptr, clippy::shadow_unrelated)]
     pub async fn get_factors(
         user_uuid: &str,
         conn: &DbConn,
     ) -> Result<(bool, Option<String>), Error> {
         use diesel::prelude::{Connection, ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         use diesel::OptionalExtension;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             con.transaction(|con| {
                 webauthn::table
                     .count()
                     .filter(webauthn::user_uuid.eq(user_uuid))
                     .get_result::<i64>(con)
                     .and_then(|count| {
                         let authn = count > 0;
                         totp::table
                             .select(totp::token)
                             .filter(totp::user_uuid.eq(user_uuid))
                             .first(con)
                             .optional()
                             .map(|token| (authn, token))
                     })
                     .map_err(result::Error::into)
             })
         })
     }
 }
 impl WebAuthnInfo {
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn get_all_by_user(user_uuid: &str, conn: &DbConn) -> Result<Vec<Self>, Error> {
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             webauthn::table
                 .select((webauthn::id, webauthn::name))
                 .filter(webauthn::user_uuid.eq(user_uuid))
                 .load::<Self>(con)
                 .map_err(result::Error::into)
         })
     }
 }
 
 impl WebAuthn {
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn get_all_security_keys(
         user_uuid: &str,
         conn: &DbConn,
     ) -> Result<Vec<SecurityKey>, Error> {
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             webauthn::table
                 .select(webauthn::security_key)
                 .filter(webauthn::user_uuid.eq(user_uuid))
                 .load::<String>(con)
                 .map_err(result::Error::into)
                 .and_then(|keys| {
                     let len = keys.len();
                     keys.into_iter()
                         .try_fold(Vec::with_capacity(len), |mut sec_keys, key| {
                             de::from_str::<SecurityKey>(key.as_str()).map(|sec| {
                                 sec_keys.push(sec);
                                 sec_keys
                             })
                         })
                         .map_err(Error::from)
                 })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn insert(self, conn: &DbConn) -> EmptyResult {
         use __sqlite_model::WebAuthnDb;
         use diesel::prelude::RunQueryDsl;
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             diesel::insert_into(webauthn::table)
                 .values(WebAuthnDb::to_db(&self))
                 .execute(con)
                 .map_err(result::Error::into)
                 .and_then(|count| {
                     if count == 1 {
                         Ok(())
                     } else {
                         Err(Error::from(String::from(
                             "exactly one row would not have been inserted into webauthn",
                         )))
                     }
                 })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn update(self, conn: &DbConn) -> EmptyResult {
         use diesel::prelude::{ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             diesel::update(webauthn::table)
                 .set(webauthn::security_key.eq(self.security_key))
                 .filter(webauthn::credential_id.eq(self.credential_id))
                 .execute(con)
                 .map_err(result::Error::into)
                 .and_then(|count| {
                     if count == 1 {
                         Ok(())
                     } else {
                         Err(Error::from(String::from(
                             "exactly one webauthn row would not have been updated",
                         )))
                     }
                 })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn get_all_credentials_by_user(
         user_uuid: &str,
         conn: &DbConn,
     ) -> Result<Vec<CredentialID>, Error> {
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             webauthn::table
                 .select(webauthn::credential_id)
                 .filter(webauthn::user_uuid.eq(user_uuid))
                 .load::<String>(con)
                 .map_err(result::Error::into)
                 .and_then(|ids| {
                     let len = ids.len();
                     ids.into_iter()
                         .try_fold(Vec::with_capacity(len), |mut cred_ids, id| {
                             CredentialID::try_from(id.as_str())
                                 .map_err(|()| Error::from(String::from("invalid credential ID")))
                                 .map(|cred_id| {
                                     cred_ids.push(cred_id);
                                     cred_ids
                                 })
                         })
                 })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn get_by_cred_id(credential_id: &str, conn: &DbConn) -> Result<Option<Self>, Error> {
         use __sqlite_model::WebAuthnDb;
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         use diesel::OptionalExtension;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             webauthn::table
                 .filter(webauthn::credential_id.eq(credential_id))
                 .first::<WebAuthnDb>(con)
                 .optional()
                 .map_err(result::Error::into)
                 .map(FromDb::from_db)
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn delete_by_user_uuid_and_id(
         user_uuid: &str,
         id: i64,
         conn: &DbConn,
     ) -> EmptyResult {
         use diesel::prelude::{ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             diesel::delete(webauthn::table)
                 .filter(webauthn::user_uuid.eq(user_uuid))
                 .filter(webauthn::id.eq(id))
                 .execute(con)
                 .map_err(result::Error::into)
                 .and_then(|count| {
                     if count == 1 {
                         Ok(())
                     } else {
                         Err(Error::from(String::from(
                             "exactly one webauthn row would not have been removed for the user",
                         )))
                     }
                 })
         })
     }
 }
 
 impl WebAuthnAuth {
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn find_by_user(user_uuid: &str, conn: &DbConn) -> Result<Option<Self>, Error> {
         use __sqlite_model::WebAuthnAuthDb;
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         use diesel::OptionalExtension;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             webauthn_auth::table
                 .filter(webauthn_auth::user_uuid.eq(user_uuid))
                 .first::<WebAuthnAuthDb>(con)
                 .optional()
                 .map_err(result::Error::into)
                 .map(FromDb::from_db)
         })
     }
 }
 
 impl WebAuthnReg {
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn find_by_user(user_uuid: &str, conn: &DbConn) -> Result<Option<Self>, Error> {
         use __sqlite_model::WebAuthnRegDb;
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         use diesel::OptionalExtension;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             webauthn_reg::table
                 .filter(webauthn_reg::user_uuid.eq(user_uuid))
                 .first::<WebAuthnRegDb>(con)
                 .optional()
                 .map_err(result::Error::into)
                 .map(FromDb::from_db)
         })
     }
 }
 
 impl WebAuthnChallenge {
     #[allow(clippy::clone_on_ref_ptr, clippy::shadow_unrelated)]
     pub async fn delete_all(user_uuid: &str, conn: &DbConn) -> EmptyResult {
         use diesel::prelude::{Connection, ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             con.transaction(|con| {
                 diesel::delete(webauthn_auth::table)
                     .filter(webauthn_auth::user_uuid.eq(user_uuid))
                     .execute(con)
                     .and_then(|_| {
                         diesel::delete(webauthn_reg::table)
                             .filter(webauthn_reg::user_uuid.eq(user_uuid))
                             .execute(con)
                             .map(|_| ())
                     })
                     .map_err(result::Error::into)
             })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn delete(self, conn: &DbConn) -> EmptyResult {
         use diesel::prelude::{ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             match self {
                 Self::Auth(chal) => diesel::delete(webauthn_auth::table)
                     .filter(webauthn_auth::user_uuid.eq(chal.user_uuid.as_str()))
                     .execute(con),
                 Self::Reg(chal) => diesel::delete(webauthn_reg::table)
                     .filter(webauthn_reg::user_uuid.eq(chal.user_uuid.as_str()))
                     .execute(con),
             }
             .map_err(result::Error::into)
             .and_then(|count| {
                 if count == 1 {
                     Ok(())
                 } else {
                     Err(Error::from(String::from(
                         "exactly one webauthn challenge would not have been removed",
                     )))
                 }
             })
         })
     }
     #[allow(clippy::clone_on_ref_ptr, clippy::shadow_unrelated)]
     pub async fn replace(&self, conn: &DbConn) -> EmptyResult {
         use __sqlite_model::{WebAuthnAuthDb, WebAuthnRegDb};
         use diesel::prelude::{Connection, ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             con.transaction(|con| {
                 match *self {
                     Self::Auth(ref chal) => diesel::update(webauthn_auth::table)
                         .set(webauthn_auth::data.eq(&chal.data))
                         .filter(webauthn_auth::user_uuid.eq(chal.user_uuid.as_str()))
                         .execute(con),
                     Self::Reg(ref chal) => diesel::update(webauthn_reg::table)
                         .set(webauthn_reg::data.eq(&chal.data))
                         .filter(webauthn_reg::user_uuid.eq(chal.user_uuid.as_str()))
                         .execute(con),
                 }
                 .map_err(result::Error::into)
                 .and_then(|count| {
                     if count == 0 {
                         match *self {
                             Self::Auth(ref chal) => diesel::insert_into(webauthn_auth::table)
                                 .values(WebAuthnAuthDb::to_db(chal))
                                 .execute(con),
                             Self::Reg(ref chal) => diesel::insert_into(webauthn_reg::table)
                                 .values(WebAuthnRegDb::to_db(chal))
                                 .execute(con),
                         }
                         .map_err(result::Error::into)
                         .and_then(|count| {
                             if count == 1 {
                                 Ok(())
                             } else {
                                 Err(Error::from(String::from(
                                     "exactly one webauthn challenge would not have been inserted/updated",
                                 )))
                             }
                         })
                     } else {
                         Ok(())
                     }
                 })
             })
         })
     }
 }
 
 impl Totp {
     #[allow(clippy::clone_on_ref_ptr, clippy::shadow_unrelated)]
     pub async fn replace(self, conn: &DbConn) -> EmptyResult {
         use __sqlite_model::TotpDb;
         use diesel::prelude::{ExpressionMethods, RunQueryDsl};
         use diesel::result;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             diesel::update(totp::table)
                 .set(totp::last_used.eq(self.last_used))
                 .filter(totp::user_uuid.eq(&self.user_uuid))
                 .execute(con)
                 .map_err(result::Error::into)
                 .and_then(|count| {
                     if count == 1 {
                         Ok(())
                     } else {
                         diesel::insert_into(totp::table)
                             .values(TotpDb::to_db(&self))
                             .execute(con)
                             .map_err(result::Error::into)
                             .and_then(|count| {
                                 if count == 1 {
                                     Ok(())
                                 } else {
                                     Err(Error::from(String::from(
                                         "exactly one totp row was not inserted/updated",
                                     )))
                                 }
                             })
                     }
                 })
         })
     }
     #[allow(clippy::clone_on_ref_ptr)]
     pub async fn find_by_user(user_uuid: &str, conn: &DbConn) -> Result<Option<Self>, Error> {
         use __sqlite_model::TotpDb;
         use diesel::prelude::{ExpressionMethods, QueryDsl, RunQueryDsl};
         use diesel::result;
         use diesel::OptionalExtension;
         let mut con_res = conn.conn.clone().lock_owned().await;
         let con = con_res.as_mut().expect("unable to get a pooled connection");
         task::block_in_place(move || {
             totp::table
                 .filter(totp::user_uuid.eq(user_uuid))
                 .first::<TotpDb>(con)
                 .optional()
                 .map_err(result::Error::into)
                 .map(FromDb::from_db)
         })
     }
 }