ockam_api 0.93.0

Ockam's request-response API
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

use either::Either;
use rand::distributions::Alphanumeric;
use rand::Rng;
use std::collections::BTreeMap;

use ockam::identity::utils::now;
use ockam::identity::{Identifier, IdentitiesAttributes};
use ockam_core::compat::sync::Arc;
use ockam_core::compat::time::Duration;
use ockam_core::Result;

use crate::authenticator::common::EnrollerAccessControlChecks;
use crate::authenticator::direct::AccountAuthorityInfo;
use crate::authenticator::one_time_code::OneTimeCode;
use crate::authenticator::{
    AuthorityEnrollmentTokenRepository, AuthorityMembersRepository, EnrollmentToken,
};

pub const DEFAULT_TOKEN_DURATION: Duration = Duration::from_secs(60 * 10);
pub const MAX_RECOMMENDED_TOKEN_DURATION: Duration = Duration::from_secs(60 * 60 * 24 * 5);
pub const DEFAULT_TOKEN_USAGE_COUNT: u64 = 1;
pub const MAX_RECOMMENDED_TOKEN_USAGE_COUNT: u64 = 10;

pub struct EnrollmentTokenIssuerError(pub String);

pub type EnrollmentTokenIssuerResult<T> = Either<T, EnrollmentTokenIssuerError>;

pub struct EnrollmentTokenIssuer {
    authority: Identifier,
    pub(super) tokens: Arc<dyn AuthorityEnrollmentTokenRepository>,
    pub(super) members: Arc<dyn AuthorityMembersRepository>,
    pub(super) identities_attributes: Arc<IdentitiesAttributes>,
    pub(super) account_authority: Option<AccountAuthorityInfo>,
}

impl EnrollmentTokenIssuer {
    pub fn new(
        authority: &Identifier,
        tokens: Arc<dyn AuthorityEnrollmentTokenRepository>,
        members: Arc<dyn AuthorityMembersRepository>,
        identities_attributes: Arc<IdentitiesAttributes>,
        account_authority: Option<AccountAuthorityInfo>,
    ) -> Self {
        Self {
            authority: authority.clone(),
            tokens,
            members,
            identities_attributes,
            account_authority,
        }
    }

    #[instrument(skip_all, fields(enroller = %enroller, token_duration = token_duration.map_or("n/a".to_string(), |d| d.as_secs().to_string()), ttl_count = ttl_count.map_or("n/a".to_string(), |t| t.to_string())))]
    pub async fn issue_token(
        &self,
        enroller: &Identifier,
        attrs: BTreeMap<String, String>,
        token_duration: Option<Duration>,
        ttl_count: Option<u64>,
    ) -> Result<EnrollmentTokenIssuerResult<OneTimeCode>> {
        let check = EnrollerAccessControlChecks::check_identifier(
            &self.authority,
            self.members.clone(),
            self.identities_attributes.clone(),
            enroller,
            &self.account_authority,
        )
        .await?;

        if !check.is_enroller {
            warn!(
                "Non-enroller {} is trying to issue an enrollment token",
                enroller
            );
            return Ok(Either::Right(EnrollmentTokenIssuerError(
                "Non-enroller is trying to issue an enrollment token".to_string(),
            )));
        }

        // Check if we're trying to create an enroller
        if EnrollerAccessControlChecks::check_str_attributes_is_enroller(&attrs) {
            // Only pre-trusted identities will be able to add enrollers
            if !check.is_admin {
                warn!(
                    "Not admin {} is trying to issue an enrollment token for an enroller",
                    enroller
                );
                return Ok(Either::Right(EnrollmentTokenIssuerError(
                    "Not admin is trying to issue an enrollment token for an enroller".to_string(),
                )));
            }
        }

        let one_time_code = OneTimeCode::new();
        let reference: String = rand::thread_rng()
            .sample_iter(&Alphanumeric)
            .take(10)
            .map(char::from)
            .collect();
        let max_token_duration = token_duration.unwrap_or(DEFAULT_TOKEN_DURATION);
        let ttl_count = ttl_count.unwrap_or(DEFAULT_TOKEN_USAGE_COUNT);
        let now = now()?;
        let expires_at = now + max_token_duration.as_secs();
        let tkn = EnrollmentToken {
            one_time_code,
            reference: Some(reference.clone()),
            issued_by: enroller.clone(),
            created_at: now,
            expires_at,
            ttl_count,
            attrs,
        };
        self.tokens.store_new_token(tkn).await?;

        info!(
            "Successfully issued an enrollment token. TTL count: {}, expires_at: {}, reference: {}",
            ttl_count, expires_at.0, reference
        );

        Ok(Either::Left(one_time_code))
    }
}