redact-client 1.5.9

Receives request for private data and decrypts it to display securely in browser
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

pub mod data;

use crate::{
    relayer::Relayer,
    render::Renderer,
    routes::error::{
        IframeTokensDoNotMatchRejection, NoPathTokenProvided, SessionTokenNotFoundRejection,
    },
    token::TokenGenerator,
};
use redact_crypto::Storer;
use std::sync::Arc;
use warp::{filters::BoxedFilter, path::Peek, Filter, Rejection, Reply};
use warp_sessions::{
    CookieOptions, SameSiteCookieOption, Session, SessionStore, SessionWithStore, WithSession,
};

pub fn data<H: Storer, R: Renderer + Clone + Send + 'static, T: TokenGenerator, Q: Relayer>(
    storer: Arc<H>,
    render_engine: R,
    token_generator: T,
    relayer: Q,
) -> impl Filter<Extract = (Box<dyn Reply>, String, Option<String>, Option<String>), Error = Rejection>
       + Clone {
    warp::path!("data" / ..).and(
        data::get(
            storer.clone(),
            render_engine.clone(),
            token_generator.clone(),
        )
        .or(data::post(render_engine, token_generator, storer, relayer))
        .unify(),
    )
}

pub fn session<T, S: SessionStore>(
    session_store: S,
) -> impl Fn(T) -> BoxedFilter<(WithSession<Box<dyn Reply>>,)>
where
    T: Filter<
            Extract = (Box<dyn Reply>, String, Option<String>, Option<String>),
            Error = Rejection,
        > + Clone
        + Send
        + Sync
        + 'static,
{
    move |filter: T| {
        warp::any()
            .and(warp::path::peek().map(|peek: Peek| {
                if let Some(token) = peek.segments().last() {
                    Some(token.to_owned())
                } else {
                    None
                }
            }))
            .and(warp_sessions::request::with_session(
                session_store.clone(),
                Some(CookieOptions {
                    cookie_name: "sid",
                    cookie_value: None,
                    max_age: Some(60),
                    domain: None,
                    path: None,
                    secure: false,
                    http_only: true,
                    same_site: Some(SameSiteCookieOption::None),
                }),
            ))
            .and_then(
                move |token: Option<String>, session_with_store: SessionWithStore<S>| async move {
                    let token = match token {
                        Some(t) => t,
                        None => return Err(warp::reject::custom(NoPathTokenProvided)),
                    };
                    if let Some(session_token) = session_with_store.session.get::<String>("token") {
                        if session_token != token {
                            Err(warp::reject::custom(IframeTokensDoNotMatchRejection))
                        } else {
                            Ok(session_with_store)
                        }
                    } else {
                        Err(warp::reject::custom(SessionTokenNotFoundRejection))
                    }
                },
            )
            .and(filter)
            .and_then(
                |mut session_with_store: SessionWithStore<S>,
                 reply: Box<dyn Reply>,
                 old_path: String,
                 new_path: Option<String>,
                 token: Option<String>| async move {
                    session_with_store.cookie_options.path = Some(old_path);
                    session_with_store.session.destroy();

                    match (new_path, token) {
                        (Some(new_path), Some(token)) => {
                            let mut new_session = SessionWithStore::<S> {
                                session: Session::new(),
                                session_store: session_with_store.session_store.clone(),
                                cookie_options: CookieOptions {
                                    cookie_name: "sid",
                                    cookie_value: None,
                                    max_age: Some(60),
                                    domain: None,
                                    path: Some(new_path),
                                    secure: false,
                                    http_only: true,
                                    same_site: Some(SameSiteCookieOption::None),
                                },
                            };

                            new_session
                                .session
                                .insert("token", token)
                                .map_err(|_| warp::reject())?;
                            Ok::<_, Rejection>((
                                Box::new(
                                    warp_sessions::reply::with_session(reply, session_with_store)
                                        .await?,
                                ) as Box<dyn Reply>,
                                new_session,
                            ))
                        }
                        _ => Ok::<_, Rejection>((
                            Box::new(reply) as Box<dyn Reply>,
                            session_with_store,
                        )),
                    }
                },
            )
            .untuple_one()
            .and_then(warp_sessions::reply::with_session)
            .boxed()
    }
}