krill 0.16.0

Resource Public Key Infrastructure (RPKI) daemon
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

//! `/auth`

use hyper::Method;
use super::super::request::{PathIter, Request};
use super::super::response::HttpResponse;
use super::error::DispatchError;


//------------ /auth ---------------------------------------------------------

pub async fn dispatch(
    request: Request<'_>,
    mut path: PathIter<'_>,
) -> Result<HttpResponse, DispatchError> {
    match path.next() {
        Some("login") => login(request, path).await,
        Some("logout") => logout(request, path).await,

        #[cfg(feature = "multi-user")]
        Some("callback") => multi_user::callback(request, path).await,

        _ => Ok(HttpResponse::not_found())
    }
}

async fn login(
    request: Request<'_>,
    path: PathIter<'_>,
) -> Result<HttpResponse, DispatchError> {
    match *request.method() {
        Method::GET => {
            path.check_exhausted()?;
            let (request, _) = request.proceed_unchecked();
            let server = request.empty()?;
            Ok(server.authorizer().get_login_url().await?)
        }
        Method::POST => {
            path.check_exhausted()?;
            let (server, request) = request.proceed_raw();
            Ok(HttpResponse::json(
                &server.authorizer().login(&request).await?
            ))
        }
        _ => Ok(HttpResponse::method_not_allowed())
    }
}

async fn logout(
    request: Request<'_>,
    path: PathIter<'_>,
) -> Result<HttpResponse, DispatchError> {
    path.check_exhausted()?;
    request.check_post()?;
    let (server, request) = request.proceed_raw();
    Ok(server.authorizer().logout(&request).await?)
}


#[cfg(feature = "multi-user")]
mod multi_user {
    use base64::engine::Engine as _;
    use base64::engine::general_purpose::STANDARD as BASE64_ENGINE;
    use log::trace;
    use crate::commons::error::Error;
    use crate::daemon::http::auth::LoggedInUser;
    use crate::daemon::http::util::url_encode;
    use super::*;

    pub async fn callback(
        request: Request<'_>,
        path: PathIter<'_>,
    ) -> Result<HttpResponse, DispatchError> {
        path.check_exhausted()?;
        request.check_get()?;
        
        trace!(
            "Authentication callback invoked: {:?}", &request.hyper()
        );
        
        let (server, request) = request.proceed_raw();
        server.authorizer().login(&request).await.and_then(|user| {
            build_auth_redirect_location(user).map_err(|err| {
                Error::custom(format!(
                    "Unable to build redirect with logged in user details: \
                     {err:?}"
                ))
            })
        }).map(|location| {
            HttpResponse::found(&location)
        }).or_else(|err| {
            // HTTP redirects cannot have a response body and so we cannot
            // render the error to be displayed in Lagosta as a JSON body,
            // instead we must package the JSON as a query parameter.
            let location = match serde_json::to_string(
                &err.to_error_response()
            ) {
                Ok(json) => {
                    format!("/ui/login?error={}", BASE64_ENGINE.encode(json))
                }
                Err(_) => String::from("/ui/login")
            };
            Ok(HttpResponse::found(&location))
        })
    }

    fn build_auth_redirect_location(
        user: LoggedInUser
    ) -> Result<String, Error> {
        fn b64_encode_attributes_with_mapped_error(
            a: &impl serde::Serialize,
        ) -> Result<String, Error> {
            Ok(BASE64_ENGINE.encode(
                serde_json::to_string(a)
                    .map_err(|err| Error::custom(err.to_string()))?,
            ))
        }

        let attributes = b64_encode_attributes_with_mapped_error(
            user.attributes()
        )?;

        Ok(format!(
            "/ui/login?token={}&id={}&attributes={}",
            &url_encode(user.token())?,
            &url_encode(user.id())?,
            &url_encode(attributes)?,
        ))
    }
}