thirdshift 0.14.7

Turn a GitHub issue into a ready-for-review pull request, unattended
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

//! The same anonymous email-code flow creates accounts and resets passwords.
use super::*;
use crate::{email::Resend, resend_key::ResendKey};

const OWNER: &str = "Email password setup is off. Ask the machine's owner to run thirdshift console password --email <address>.";

#[derive(Template)]
#[template(path = "console/set_password.html")]
struct PasswordPage {
    csrf: String,
    theme: String,
    email_enabled: bool,
}

pub(in crate::console) async fn set_password_page(
    Extension(access): Extension<Access>,
    headers: HeaderMap,
) -> Response {
    anonymous_page(
        access,
        headers,
        |AnonymousForm {
             csrf,
             theme,
             email_enabled,
         }| {
            Ok(PasswordPage {
                csrf,
                theme,
                email_enabled,
            }
            .render()?)
        },
    )
    .await
}

#[derive(Template)]
#[template(path = "console/set_password_code.html")]
struct CodePage {
    theme: String,
    email_enabled: bool,
}

#[derive(Deserialize)]
pub(in crate::console) struct PasswordForm {
    email: String,
    #[serde(default)]
    code: String,
    #[serde(default)]
    password: String,
    #[serde(default)]
    csrf: String,
}

fn authorized(access: &Access, headers: &HeaderMap, form: &PasswordForm) -> bool {
    !access.no_sign_in
        && cookie(headers, SIGN_IN).is_some_and(|token| valid_csrf(&form.csrf, &csrf(&token)))
}

pub(in crate::console) async fn code(
    Extension(access): Extension<Access>,
    headers: HeaderMap,
    Form(form): Form<PasswordForm>,
) -> Response {
    if access.no_sign_in {
        return StatusCode::NOT_FOUND.into_response();
    }
    if !authorized(&access, &headers, &form) {
        return StatusCode::FORBIDDEN.into_response();
    }
    // Availability is independent of the address. Do not wait for any work
    // that depends on allowlist membership, including hashing and delivery.
    let loaded = tokio::task::spawn_blocking(|| -> Result<(bool, UserConfig)> {
        Ok((ResendKey::find()?.is_some(), UserConfig::load()?))
    })
    .await;
    let (email_enabled, config) = match loaded {
        Ok(Ok(loaded)) => loaded,
        error => return failed(error),
    };
    let page = CodePage {
        theme: config.console.theme.clone(),
        email_enabled,
    };
    let status = if email_enabled {
        tokio::task::spawn_blocking(move || {
            let result = (|| -> Result<()> {
                Accounts::load()?.send_code(&form.email, |code| {
                    Resend::new(Some(form.email.clone()), &config.email)?.send(
                        "Set your thirdshift Console password",
                        &format!("Your thirdshift Console code is {code}\n\nIt lasts 15 minutes and allows 5 tries. If you did not request it, ignore this email."),
                    )
                })
            })();
            if let Err(error) = result {
                eprintln!("thirdshift Console: can't send password code: {error:#}");
            }
        });
        StatusCode::OK
    } else {
        StatusCode::SERVICE_UNAVAILABLE
    };
    let mut response = crate::console::page(Ok(page.render().map_err(Into::into)));
    if response.status().is_success() {
        *response.status_mut() = status;
    }
    response
}

pub(in crate::console) async fn set_password(
    Extension(access): Extension<Access>,
    headers: HeaderMap,
    Form(form): Form<PasswordForm>,
) -> Response {
    if access.no_sign_in {
        return StatusCode::NOT_FOUND.into_response();
    }
    if !authorized(&access, &headers, &form) {
        return StatusCode::FORBIDDEN.into_response();
    }
    let result = tokio::task::spawn_blocking(move || -> Result<Option<SignIn>> {
        if ResendKey::find()?.is_none() {
            return Ok(None);
        }
        Ok(Some(Accounts::load()?.set_password_by_code(
            &form.email,
            &form.code,
            &form.password,
        )?))
    })
    .await;
    match result {
        Ok(Ok(Some(SignIn::SignedIn(token)))) => {
            let mut response = Redirect::to("/").into_response();
            set_cookie(&mut response, SESSION, &token, accounts::LIFETIME);
            response
        },
        Ok(Ok(Some(_))) => (StatusCode::UNAUTHORIZED, axum::response::Html("Password not set. Check your code or <a href=\"/set-password\">request another</a>.")).into_response(),
        Ok(Ok(None)) => (StatusCode::SERVICE_UNAVAILABLE, OWNER).into_response(),
        Ok(Err(error)) => failed(error),
        Err(error) => failed(error),
    }
}