runegate 0.4.0

Lightweight Rust-based identity proxy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

use actix_session::Session;
use actix_web::{HttpResponse, Responder, http::header, web};
use tracing::{error, info, instrument};

#[derive(Debug, serde::Deserialize)]
pub struct TotpVerifyRequest {
    pub code: String,
}

#[instrument(name = "mfa_totp_verify", skip(session))]
pub async fn totp_verify(
    req_data: web::Json<TotpVerifyRequest>,
    session: Session,
) -> impl Responder {
    let email = match session.get::<String>("email") {
        Ok(Some(e)) => e,
        _ => return HttpResponse::Unauthorized().json("No preauth session"),
    };

    let _preauth_id = match session.get::<String>("preauth_id") {
        Ok(Some(id)) => id,
        _ => return HttpResponse::Unauthorized().json("No preauth session"),
    };

    // TODO: Actually fetch the user's TOTP secret from IdentityStore and verify.
    // For now, we accept any code "000000" as a bypass for testing before DB is wired up.
    if req_data.code != "000000" {
        return HttpResponse::BadRequest().json("Invalid TOTP code");
    }

    // Upgrade session to fully authenticated
    if let Err(e) = session.insert("authenticated", true) {
        error!("Failed to set authenticated session: {}", e);
        return HttpResponse::InternalServerError().json("Session error");
    }

    // Remove the preauth constraint
    session.remove("preauth_id");
    session.renew();

    info!("✅ User {} completed MFA successfully", email);

    let redirect_path = crate::config::default_redirect();
    HttpResponse::Found()
        .append_header((header::LOCATION, redirect_path))
        .finish()
}

#[instrument(name = "mfa_webauthn_start", skip(_session))]
pub async fn webauthn_start(_session: Session) -> impl Responder {
    // TODO: Use webauthn-rs to generate Request Challenge
    HttpResponse::NotImplemented().json("WebAuthn not fully implemented yet")
}

#[instrument(name = "mfa_webauthn_finish", skip(_session))]
pub async fn webauthn_finish(_session: Session) -> impl Responder {
    // TODO: Use webauthn-rs to verify Request Challenge
    HttpResponse::NotImplemented().json("WebAuthn not fully implemented yet")
}