vw_small

user.rs (14714B)

---

 use crate::config;
 use crate::crypto;
 use crate::util;
 use chrono::{NaiveDateTime, TimeDelta, Utc};
 use diesel::result::{self, DatabaseErrorKind};
 use serde_json::Value;
 
 db_object! {
     #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
     #[diesel(table_name = users)]
     #[diesel(treat_none_as_null = true)]
     #[diesel(primary_key(uuid))]
     pub struct User {
         pub uuid: String,
         pub enabled: bool,
         pub created_at: NaiveDateTime,
         pub updated_at: NaiveDateTime,
         pub verified_at: Option<NaiveDateTime>,
         pub last_verifying_at: Option<NaiveDateTime>,
         login_verify_count: i32,
         pub email: String,
         pub email_new: Option<String>,
         pub email_new_token: Option<String>,
         pub name: String,
         pub password_hash: Vec<u8>,
         pub salt: Vec<u8>,
         password_iterations: i32,
         pub password_hint: Option<String>,
         pub akey: String,
         pub private_key: Option<String>,
         pub public_key: Option<String>,
         #[diesel(column_name = "totp_secret")] // Note, this is only added to the UserDb structs, not to User
         _totp_secret: Option<String>,
         pub totp_recover: Option<String>,
         pub security_stamp: String,
         pub stamp_exception: Option<String>,
         pub equivalent_domains: String,
         pub excluded_globals: String,
         pub client_kdf_type: i32,
         client_kdf_iter: i32,
         client_kdf_memory: Option<i32>,
         client_kdf_parallelism: Option<i32>,
         pub api_key: Option<String>,
         pub avatar_color: Option<String>,
         pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.
     }
 }
 
 pub enum UserKdfType {
     Pbkdf2 = 0,
     Argon2id = 1,
 }
 impl From<UserKdfType> for i32 {
     fn from(value: UserKdfType) -> Self {
         match value {
             UserKdfType::Pbkdf2 => 0i32,
             UserKdfType::Argon2id => 1i32,
         }
     }
 }
 
 enum UserStatus {
     Enabled = 0,
     Invited = 1,
     _Disabled = 2,
 }
 impl From<UserStatus> for i32 {
     fn from(value: UserStatus) -> Self {
         match value {
             UserStatus::Enabled => 0i32,
             UserStatus::Invited => 1i32,
             UserStatus::_Disabled => 2i32,
         }
     }
 }
 
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
     pub routes: Vec<String>,
     pub security_stamp: String,
     pub expire: u64,
 }
 
 /// Local methods
 impl User {
     pub fn client_kdf_type_default() -> i32 {
         i32::from(UserKdfType::Pbkdf2)
     }
     pub const CLIENT_KDF_ITER_DEFAULT: u32 = 600_000u32;
 
     pub fn new(email: &str) -> Self {
         let now = Utc::now().naive_utc();
         let email = email.to_lowercase();
         Self {
             uuid: util::get_uuid(),
             enabled: true,
             created_at: now,
             updated_at: now,
             verified_at: None,
             last_verifying_at: None,
             login_verify_count: 0,
             name: email.clone(),
             email,
             akey: String::new(),
             email_new: None,
             email_new_token: None,
             password_hash: Vec::new(),
             salt: crypto::get_random_bytes::<64>().to_vec(),
             password_iterations: i32::try_from(config::get_config().password_iterations)
                 .expect("overflow"),
             security_stamp: util::get_uuid(),
             stamp_exception: None,
             password_hint: None,
             private_key: None,
             public_key: None,
             _totp_secret: None,
             totp_recover: None,
             equivalent_domains: "[]".to_owned(),
             excluded_globals: "[]".to_owned(),
             client_kdf_type: Self::client_kdf_type_default(),
             client_kdf_iter: i32::try_from(Self::CLIENT_KDF_ITER_DEFAULT).expect("overflow"),
             client_kdf_memory: None,
             client_kdf_parallelism: None,
             api_key: None,
             avatar_color: None,
             external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.
         }
     }
     pub fn login_verify_count(&self) -> u32 {
         u32::try_from(self.login_verify_count).expect("underflow")
     }
     pub fn set_login_verify_count(&mut self, count: u32) {
         self.login_verify_count = i32::try_from(count).expect("overflow");
     }
     pub fn password_iterations(&self) -> u32 {
         u32::try_from(self.password_iterations).expect("underflow")
     }
     pub fn set_password_iterations(&mut self, iter: u32) {
         self.password_iterations = i32::try_from(iter).expect("overflow");
     }
     pub fn client_kdf_iter(&self) -> u32 {
         u32::try_from(self.client_kdf_iter).expect("underflow")
     }
     pub fn set_client_kdf_iter(&mut self, iter: u32) {
         self.client_kdf_iter = i32::try_from(iter).expect("overflow");
     }
     pub fn client_kdf_memory(&self) -> Option<u32> {
         self.client_kdf_memory
             .map(|mem| u32::try_from(mem).expect("underflow"))
     }
     pub fn set_client_kdf_memory(&mut self, mem: Option<u32>) {
         self.client_kdf_memory = mem.map(|kdf| i32::try_from(kdf).expect("overflow"));
     }
     pub fn client_kdf_parallelism(&self) -> Option<u32> {
         self.client_kdf_parallelism
             .map(|mem| u32::try_from(mem).expect("underflow"))
     }
     pub fn set_client_kdf_parallelism(&mut self, par: Option<u32>) {
         self.client_kdf_parallelism = par.map(|pll| i32::try_from(pll).expect("overflow"));
     }
 
     pub fn check_valid_password(&self, password: &str) -> bool {
         crypto::verify_password_hash(
             password.as_bytes(),
             &self.salt,
             &self.password_hash,
             u32::try_from(self.password_iterations)
                 .expect("underflow converting password iterations into a u32"),
         )
     }
     /// Set the password hash generated
     /// And resets the security_stamp. Based upon the allow_next_route the security_stamp will be different.
     ///
     /// # Arguments
     ///
     /// * `password` - A str which contains a hashed version of the users master password.
     /// * `new_key` - A String  which contains the new aKey value of the users master password.
     /// * `allow_next_route` - A Option<Vec<String>> with the function names of the next allowed (rocket) routes.
     ///   These routes are able to use the previous stamp id for the next 2 minutes.
     ///   After these 2 minutes this stamp will expire.
     pub fn set_password(
         &mut self,
         password: &str,
         new_key: Option<String>,
         reset_security_stamp: bool,
         allow_next_route: Option<Vec<String>>,
     ) {
         self.password_hash = crypto::hash_password(
             password.as_bytes(),
             &self.salt,
             u32::try_from(self.password_iterations)
                 .expect("underflow converting password iterations into a u32"),
         );
         if let Some(route) = allow_next_route {
             self.set_stamp_exception(route);
         }
         if let Some(new_key) = new_key {
             self.akey = new_key;
         }
         if reset_security_stamp {
             self.reset_security_stamp();
         }
     }
 
     pub fn reset_security_stamp(&mut self) {
         self.security_stamp = util::get_uuid();
     }
 
     /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
     ///
     /// # Arguments
     /// * `route_exception` - A Vec<String> with the function names of the next allowed (rocket) routes.
     ///   These routes are able to use the previous stamp id for the next 2 minutes.
     ///   After these 2 minutes this stamp will expire.
     pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
         let stamp_exception = UserStampException {
             routes: route_exception,
             security_stamp: self.security_stamp.clone(),
             expire: u64::try_from(
                 Utc::now()
                     .checked_add_signed(
                         TimeDelta::try_minutes(2).expect("TimeDelta::try_minutes(2) to work"),
                     )
                     .expect("overflow")
                     .timestamp(),
             )
             .expect("underflow"),
         };
         self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
     }
 
     /// Resets the stamp_exception to prevent re-use of the previous security-stamp
     pub fn reset_stamp_exception(&mut self) {
         self.stamp_exception = None;
     }
 }
 
 use super::{Cipher, Device, Favorite, Folder, TwoFactorType, UserOrgType, UserOrganization};
 use crate::api::EmptyResult;
 use crate::db::DbConn;
 use crate::error::MapResult as _;
 
 /// Database methods
 impl User {
     pub async fn to_json(&self, conn: &DbConn) -> Value {
         let mut orgs_json = Vec::new();
         for c in UserOrganization::find_confirmed_by_user(&self.uuid, conn).await {
             orgs_json.push(c.to_json(conn).await);
         }
         let twofactor_enabled = TwoFactorType::has_twofactor(&self.uuid, conn)
             .await
             .expect("unable to get two factor info");
         // TODO: Might want to save the status field in the DB
         let status = if self.password_hash.is_empty() {
             UserStatus::Invited
         } else {
             UserStatus::Enabled
         };
         json!({
             "_status": i32::from(status),
             "id": self.uuid,
             "name": self.name,
             "email": self.email,
             "emailVerified": true,
             "premium": true,
             "premiumFromOrganization": false,
             "masterPasswordHint": self.password_hint,
             "culture": "en-US",
             "twoFactorEnabled": twofactor_enabled,
             "key": self.akey,
             "privateKey": self.private_key,
             "securityStamp": self.security_stamp,
             "organizations": orgs_json,
             "providers": [],
             "providerOrganizations": [],
             "forcePasswordReset": false,
             "avatarColor": self.avatar_color,
             "usesKeyConnector": false,
             "creationDate": util::format_date(&self.created_at),
             "object": "profile",
         })
     }
 
     pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
         if self.email.trim().is_empty() {
             err!("User email can't be empty")
         }
         self.updated_at = Utc::now().naive_utc();
         db_run! {conn:
              {
                 match diesel::replace_into(users::table)
                     .values(UserDb::to_db(self))
                     .execute(conn)
                 {
                     Ok(_) => Ok(()),
                     // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
                     Err(result::Error::DatabaseError(DatabaseErrorKind::ForeignKeyViolation, _)) => {
                         diesel::update(users::table)
                             .filter(users::uuid.eq(&self.uuid))
                             .set(UserDb::to_db(self))
                             .execute(conn)
                             .map_res("Error saving user")
                     }
                     Err(e) => Err(e.into()),
                 }.map_res("Error saving user")
             }
         }
     }
 
     pub async fn delete(self, conn: &DbConn) -> EmptyResult {
         for user_org in UserOrganization::find_confirmed_by_user(&self.uuid, conn).await {
             if user_org.atype == UserOrgType::Owner
                 && UserOrganization::count_confirmed_by_org_and_type(
                     &user_org.org_uuid,
                     UserOrgType::Owner,
                     conn,
                 )
                 .await
                     <= 1
             {
                 err!("Can't delete last owner")
             }
         }
         UserOrganization::delete_all_by_user(&self.uuid, conn).await?;
         Cipher::delete_all_by_user(&self.uuid, conn).await?;
         Favorite::delete_all_by_user(&self.uuid, conn).await?;
         Folder::delete_all_by_user(&self.uuid, conn).await?;
         Device::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactorType::delete_all_by_user(&self.uuid, conn).await?;
         db_run! {conn: {
             diesel::delete(users::table.filter(users::uuid.eq(self.uuid)))
                 .execute(conn)
                 .map_res("Error deleting user")
         }}
     }
 
     pub async fn update_uuid_revision(uuid: &str, conn: &DbConn) {
         if let Err(e) = Self::_update_revision(uuid, &Utc::now().naive_utc(), conn).await {
             warn!("Failed to update revision for {}: {:#?}", uuid, e);
         }
     }
 
     pub async fn update_all_revisions(conn: &DbConn) -> EmptyResult {
         let updated_at = Utc::now().naive_utc();
         db_run! {conn: {
             util::retry(|| {
                 diesel::update(users::table)
                     .set(users::updated_at.eq(updated_at))
                     .execute(conn)
             }, 10)
             .map_res("Error updating revision date for all users")
         }}
     }
 
     pub async fn update_revision(&mut self, conn: &DbConn) -> EmptyResult {
         self.updated_at = Utc::now().naive_utc();
         Self::_update_revision(&self.uuid, &self.updated_at, conn).await
     }
 
     async fn _update_revision(uuid: &str, date: &NaiveDateTime, conn: &DbConn) -> EmptyResult {
         db_run! {conn: {
             util::retry(|| {
                 diesel::update(users::table.filter(users::uuid.eq(uuid)))
                     .set(users::updated_at.eq(date))
                     .execute(conn)
             }, 10)
             .map_res("Error updating user revision")
         }}
     }
 
     pub async fn find_by_mail(mail: &str, conn: &DbConn) -> Option<Self> {
         let lower_mail = mail.to_lowercase();
         db_run! {conn: {
             users::table
                 .filter(users::email.eq(lower_mail))
                 .first::<UserDb>(conn)
                 .ok()
                 .from_db()
         }}
     }
 
     pub async fn find_by_uuid(uuid: &str, conn: &DbConn) -> Option<Self> {
         db_run! {conn: {
             users::table.filter(users::uuid.eq(uuid)).first::<UserDb>(conn).ok().from_db()
         }}
     }
 
     pub async fn get_all(conn: &DbConn) -> Vec<Self> {
         db_run! {conn: {
             users::table.load::<UserDb>(conn).expect("Error loading users").from_db()
         }}
     }
 
     pub async fn last_active(&self, conn: &DbConn) -> Option<NaiveDateTime> {
         match Device::find_latest_active_by_user(&self.uuid, conn).await {
             Some(device) => Some(device.updated_at),
             None => None,
         }
     }
 }