rpgpie-certificate-store 0.0.7

// SPDX-FileCopyrightText: Heiko Schaefer <heiko@schaefer.name>
// SPDX-License-Identifier: MIT OR Apache-2.0

//! Access layer for access to a
//! [Shared OpenPGP Certificate Directory](https://crates.io/crates/openpgp-cert-d) with
//! [rpgpie](https://crates.io/crates/rpgpie) 🦀️🔐🥧.
//! This crate offers various modes of certificate lookup, including search by subkey fingerprint,
//! as well as by user id.
//!
//! The index for this crate is stored in a crate-specific sqlite database.

use std::path::{Path, PathBuf};

use diesel::{query_dsl, ExpressionMethods, QueryDsl, RunQueryDsl, TextExpressionMethods};
use openpgp_cert_d::{CertD, MergeResult};
use rpgpie::key::Certificate;

use crate::schema::{certs, emails, keyids, subkeys, userids};

#[rustfmt::skip]
mod schema;

mod db;
mod lookup;
mod model;
mod util;

/// Parse all certificates during `Store::new` (to populate the lookup tables right away)
///
/// FIXME: consider lazier loading methods? (e.g.: update lookup cache on "search")
const PRELOAD: bool = true;

const DB_FILENAME: &str = "_rpgpie.sqlite";

/// Access to an OpenPGP Certificate Directory, including efficient lookup.
/// Returns `rpgpie` Certificates.
pub struct Store {
    certd: CertD,
    db_path: PathBuf,
}

impl Store {
    /// A view of the default `openpgp-cert-d` instance.
    ///
    /// Creates the cert-d directory if it doesn't exist yet.
    pub fn new() -> Result<Self, Error> {
        Self::with_base_dir(CertD::user_configured_store_path()?)
    }

    /// A view of the custom `openpgp-cert-d` instance.
    ///
    /// Creates the cert-d directory if it doesn't exist yet.
    pub fn with_base_dir(base: impl AsRef<Path>) -> Result<Self, Error> {
        // create cert-d directory if it doesn't exist yet
        let p: &Path = base.as_ref();
        if !p.exists() {
            std::fs::create_dir_all(p).ok();
        }

        let certd = CertD::with_base_dir(base)?;

        let mut db_path = certd.base_dir().to_path_buf();
        db_path.push(DB_FILENAME);

        log::debug!("Store::new with db path {:?}", db_path);

        let store = Self { certd, db_path };

        // Initialize `certs` table with cache metadata.
        //
        // Also parse and load all (new/updated) certificate information into our lookup tables.
        // FIXME: don't pre-parse eagerly? (at least not the preloading?)
        store.init(PRELOAD)?;

        Ok(store)
    }

    /// Insert a [Certificate] into the store.
    ///
    /// FIXME: this currently fails if a version of `certificate` is already present in the store.
    pub fn insert(&self, certificate: &Certificate) -> Result<(), Error> {
        let serialized: Vec<u8> = certificate.try_into()?;

        let fp = certificate.fingerprint();

        match self
            .certd
            .insert(&hex::encode(fp), serialized, false, |this, old| {
                if old.is_none() {
                    Ok(MergeResult::Data(this))
                } else {
                    // FIXME
                    log::warn!("Merging/updating is not yet implemented");

                    Err(openpgp_cert_d::Error::Other(
                        "Merging/updating is not yet implemented".into(),
                    ))
                }
            }) {
            Ok((tag, _)) => {
                let mut conn = self.conn()?;
                Self::cache_update(certificate, tag, &mut conn)
            }
            Err(e) => Err(Error::Message(format!("Database insert failed {:?}", e))),
        }
    }

    /// Get [Certificate] by (exact) primary fingerprint
    pub fn get_by_primary_fingerprint(
        &self,
        fingerprint: &str,
    ) -> Result<Option<Certificate>, Error> {
        let mut conn = self.conn()?;

        self.get_by_primary_with_conn(fingerprint, &mut conn)
    }

    /// Get [Certificate]s by exact primary or subkey fingerprint
    pub fn search_by_fingerprint(&self, fingerprint: &str) -> Result<Vec<Certificate>, Error> {
        let mut res = vec![];

        let mut conn = self.conn()?;

        if let Ok(Some(primary)) = self.get_by_primary_with_conn(fingerprint, &mut conn) {
            res.push(primary);
        }

        let matches = subkeys::table
            .inner_join(certs::table)
            .filter(subkeys::fp.eq(fingerprint.to_ascii_lowercase()))
            .select(certs::fp)
            .load::<String>(&mut conn)?;

        matches
            .iter()
            .flat_map(|fp| self.get_by_primary_with_conn(fp, &mut conn))
            .flatten()
            .for_each(|c| res.push(c));

        Ok(res)
    }

    /// Get [Certificate]s by exact primary or subkey key id
    pub fn search_by_key_id(&self, key_id: &str) -> Result<Vec<Certificate>, Error> {
        let mut conn = self.conn()?;

        let matches = keyids::table
            .inner_join(certs::table)
            .filter(keyids::keyid.eq(key_id.to_ascii_lowercase()))
            .select(certs::fp)
            .load::<String>(&mut conn)?;

        let res = matches
            .iter()
            .flat_map(|fp| self.get_by_primary_with_conn(fp, &mut conn))
            .flatten()
            .collect();

        Ok(res)
    }

    /// Get [Certificate]s by exact Email string
    ///
    /// (Returns only exact matches for the email, e.g. `alice@example.org`)
    pub fn search_by_email(&self, email: &str) -> Result<Vec<Certificate>, Error> {
        let mut conn = self.conn()?;

        let matches = emails::table
            .inner_join(certs::table)
            .filter(emails::email.eq(email))
            .select(certs::fp)
            .load::<String>(&mut conn)?;

        let res = matches
            .iter()
            .flat_map(|fp| self.get_by_primary_with_conn(fp, &mut conn))
            .flatten()
            .collect();

        Ok(res)
    }

    /// Get [Certificate]s by exact User ID string
    ///
    /// (Returns only exact matches for the full User ID string, e.g. `Alice <alice@example.org>`)
    pub fn search_exact_user_id(&self, user_id: &str) -> Result<Vec<Certificate>, Error> {
        let mut conn = self.conn()?;

        let matches = userids::table
            .inner_join(certs::table)
            .filter(userids::userid.eq(user_id))
            .select(certs::fp)
            .load::<String>(&mut conn)?;

        let res = matches
            .iter()
            .flat_map(|fp| self.get_by_primary_with_conn(fp, &mut conn))
            .flatten()
            .collect();

        Ok(res)
    }

    /// Get [Certificate]s by SQL match on the User ID string
    ///
    /// The lookup mechanism compares using SQLite's "LIKE" mechanism.
    /// So the `match` string must contain `%` or similar, for partial matches.
    pub fn search_like_user_id(&self, like: &str) -> Result<Vec<Certificate>, Error> {
        let mut conn = self.conn()?;

        let matches = query_dsl::methods::GroupByDsl::group_by(
            userids::table
                .inner_join(certs::table)
                .filter(userids::userid.like(like))
                .select(certs::fp),
            certs::id,
        )
        .load::<String>(&mut conn)?;

        let res = matches
            .iter()
            .flat_map(|fp| self.get_by_primary_with_conn(fp, &mut conn))
            .flatten()
            .collect();

        Ok(res)
    }

    /// Lookup certificates from network (keyservers).
    ///
    /// Network lookups are implicitly rate limited to "once per day".
    ///
    /// FIXME: combine with db lookup (this clarifies the type of ident!)
    pub fn poll(&self, idents: &[String]) -> Result<Vec<Certificate>, Error> {
        let mut conn = self.conn()?;

        Ok(lookup::get_keyservers(idents, &mut conn))
    }
}

/// Enum wrapper for the error types of this crate
#[derive(thiserror::Error, Debug)]
#[non_exhaustive]
pub enum Error {
    #[error("rpgpie error: {0}")]
    Rpgpie(rpgpie::Error),

    #[error("Database error")]
    Database(diesel::result::Error),

    #[error("cert-d error: {0}")]
    Certd(openpgp_cert_d::Error),

    #[error("Internal error: {0}")]
    Message(String),
}

impl From<rpgpie::Error> for Error {
    fn from(value: rpgpie::Error) -> Self {
        Error::Rpgpie(value)
    }
}

impl From<diesel::result::Error> for Error {
    fn from(value: diesel::result::Error) -> Self {
        Error::Database(value)
    }
}

impl From<openpgp_cert_d::Error> for Error {
    fn from(value: openpgp_cert_d::Error) -> Self {
        Error::Certd(value)
    }
}