2019-01-25 18:23:51 +01:00
use std ::process ::exit ;
use std ::sync ::RwLock ;
2020-07-14 18:00:09 +02:00
use once_cell ::sync ::Lazy ;
2021-01-19 17:55:21 +01:00
use regex ::Regex ;
2020-02-19 06:27:00 +01:00
use reqwest ::Url ;
2020-07-14 18:00:09 +02:00
use crate ::{
2020-08-18 17:15:44 +02:00
db ::DbConnType ,
2020-07-14 18:00:09 +02:00
error ::Error ,
util ::{ get_env , get_env_bool } ,
} ;
2019-02-02 01:09:21 +01:00
2020-03-09 22:04:03 +01:00
static CONFIG_FILE : Lazy < String > = Lazy ::new ( | | {
let data_folder = get_env ( " DATA_FOLDER " ) . unwrap_or_else ( | | String ::from ( " data " ) ) ;
get_env ( " CONFIG_FILE " ) . unwrap_or_else ( | | format! ( " {} /config.json " , data_folder ) )
} ) ;
pub static CONFIG : Lazy < Config > = Lazy ::new ( | | {
Config ::load ( ) . unwrap_or_else ( | e | {
2019-02-02 01:09:21 +01:00
println! ( " Error loading config: \n \t {:?} \n " , e ) ;
exit ( 12 )
2020-03-09 22:04:03 +01:00
} )
} ) ;
2019-01-25 18:23:51 +01:00
2021-01-19 17:55:21 +01:00
static PRIVACY_REGEX : Lazy < Regex > = Lazy ::new ( | | Regex ::new ( r "[\w]" ) . unwrap ( ) ) ;
const PRIVACY_CONFIG : & [ & str ] = & [
" allowed_iframe_ancestors " ,
" database_url " ,
" domain_origin " ,
" domain_path " ,
" domain " ,
" helo_name " ,
" org_creation_users " ,
" signups_domains_whitelist " ,
" smtp_from " ,
" smtp_host " ,
" smtp_username " ,
] ;
2019-02-08 20:49:04 +01:00
pub type Pass = String ;
2019-01-25 18:23:51 +01:00
macro_rules ! make_config {
2019-02-06 17:32:13 +01:00
( $(
$( #[ doc = $groupdoc:literal ] ) ?
$group :ident $( : $group_enabled :ident ) ? {
2019-02-05 22:17:02 +01:00
$(
2019-02-06 17:32:13 +01:00
$( #[ doc = $doc:literal ] ) +
2020-01-20 22:28:54 +01:00
$name :ident : $ty :ident , $editable :literal , $none_action :ident $(, $default :expr ) ? ;
2019-02-06 17:32:13 +01:00
) + } ,
) + ) = > {
2019-02-02 01:09:21 +01:00
pub struct Config { inner : RwLock < Inner > }
2019-01-25 18:23:51 +01:00
2019-02-02 01:09:21 +01:00
struct Inner {
2020-01-26 15:29:14 +01:00
templates : Handlebars < 'static > ,
2019-02-02 16:47:27 +01:00
config : ConfigItems ,
2019-02-03 00:22:18 +01:00
_env : ConfigBuilder ,
_usr : ConfigBuilder ,
2021-06-19 19:22:19 +02:00
_overrides : Vec < String > ,
2019-01-25 18:23:51 +01:00
}
2019-02-03 00:22:18 +01:00
#[ derive(Debug, Clone, Default, Deserialize, Serialize) ]
2019-02-02 16:47:27 +01:00
pub struct ConfigBuilder {
2019-02-05 22:17:02 +01:00
$( $(
2019-02-03 00:22:18 +01:00
#[ serde(skip_serializing_if = " Option::is_none " ) ]
2019-02-05 22:17:02 +01:00
$name : Option < $ty > ,
) + ) +
2019-02-02 16:47:27 +01:00
}
impl ConfigBuilder {
2021-01-19 17:55:21 +01:00
#[ allow(clippy::field_reassign_with_default) ]
2019-02-02 16:47:27 +01:00
fn from_env ( ) -> Self {
2020-11-12 13:40:26 +01:00
match dotenv ::from_path ( " .env " ) {
Ok ( _ ) = > ( ) ,
Err ( e ) = > match e {
dotenv ::Error ::LineParse ( msg , pos ) = > {
panic! ( " Error loading the .env file: \n Near {:?} on position {} \n Please fix and restart! \n " , msg , pos ) ;
} ,
dotenv ::Error ::Io ( ioerr ) = > match ioerr . kind ( ) {
std ::io ::ErrorKind ::NotFound = > {
println! ( " [INFO] No .env file found. \n " ) ;
} ,
std ::io ::ErrorKind ::PermissionDenied = > {
println! ( " [WARNING] Permission Denied while trying to read the .env file! \n " ) ;
} ,
_ = > {
println! ( " [WARNING] Reading the .env file failed: \n {:?} \n " , ioerr ) ;
}
} ,
_ = > {
println! ( " [WARNING] Reading the .env file failed: \n {:?} \n " , e ) ;
}
}
} ;
2019-02-02 16:47:27 +01:00
let mut builder = ConfigBuilder ::default ( ) ;
2019-02-05 22:17:02 +01:00
$( $(
2020-01-20 22:28:54 +01:00
builder . $name = make_config! { @ getenv & stringify! ( $name ) . to_uppercase ( ) , $ty } ;
2019-02-05 22:17:02 +01:00
) + ) +
2020-03-09 22:04:03 +01:00
2019-02-02 16:47:27 +01:00
builder
}
fn from_file ( path : & str ) -> Result < Self , Error > {
use crate ::util ::read_file_string ;
let config_str = read_file_string ( path ) ? ;
serde_json ::from_str ( & config_str ) . map_err ( Into ::into )
}
2019-02-03 00:22:18 +01:00
/// Merges the values of both builders into a new builder.
/// If both have the same element, `other` wins.
2021-06-19 19:22:19 +02:00
fn merge ( & self , other : & Self , show_overrides : bool , overrides : & mut Vec < String > ) -> Self {
2019-02-03 00:22:18 +01:00
let mut builder = self . clone ( ) ;
2019-02-05 22:17:02 +01:00
$( $(
2019-02-03 00:22:18 +01:00
if let v @ Some ( _ ) = & other . $name {
builder . $name = v . clone ( ) ;
2019-02-20 20:59:37 +01:00
if self . $name . is_some ( ) {
overrides . push ( stringify! ( $name ) . to_uppercase ( ) ) ;
}
2019-02-02 16:47:27 +01:00
}
2019-02-05 22:17:02 +01:00
) + ) +
2019-02-20 20:59:37 +01:00
2019-04-11 16:08:26 +02:00
if show_overrides & & ! overrides . is_empty ( ) {
2019-02-20 20:59:37 +01:00
// We can't use warn! here because logging isn't setup yet.
println! ( " [WARNING] The following environment variables are being overriden by the config file, " ) ;
println! ( " [WARNING] please use the admin panel to make changes to them: " ) ;
println! ( " [WARNING] {} \n " , overrides . join ( " , " ) ) ;
}
2019-02-03 00:22:18 +01:00
builder
2019-02-02 16:47:27 +01:00
}
2019-02-03 00:22:18 +01:00
/// Returns a new builder with all the elements from self,
/// except those that are equal in both sides
2019-02-08 18:45:07 +01:00
fn _remove ( & self , other : & Self ) -> Self {
2019-02-03 00:22:18 +01:00
let mut builder = ConfigBuilder ::default ( ) ;
2019-02-05 22:17:02 +01:00
$( $(
2019-02-03 00:22:18 +01:00
if & self . $name ! = & other . $name {
builder . $name = self . $name . clone ( ) ;
}
2019-02-05 22:17:02 +01:00
) + ) +
2019-02-03 00:22:18 +01:00
builder
}
fn build ( & self ) -> ConfigItems {
2019-02-02 16:47:27 +01:00
let mut config = ConfigItems ::default ( ) ;
let _domain_set = self . domain . is_some ( ) ;
2019-02-05 22:17:02 +01:00
$( $(
2019-02-03 00:22:18 +01:00
config . $name = make_config! { @ build self . $name . clone ( ) , & config , $none_action , $( $default ) ? } ;
2019-02-05 22:17:02 +01:00
) + ) +
2019-02-02 16:47:27 +01:00
config . domain_set = _domain_set ;
2020-04-09 10:42:27 +02:00
config . signups_domains_whitelist = config . signups_domains_whitelist . trim ( ) . to_lowercase ( ) ;
2020-08-06 07:35:29 +02:00
config . org_creation_users = config . org_creation_users . trim ( ) . to_lowercase ( ) ;
2020-04-09 10:42:27 +02:00
2019-02-02 16:47:27 +01:00
config
}
}
2019-02-03 00:22:18 +01:00
#[ derive(Debug, Clone, Default) ]
2019-02-05 22:17:02 +01:00
pub struct ConfigItems { $( $( pub $name : make_config ! { @ type $ty , $none_action } , ) + ) + }
2019-02-02 01:09:21 +01:00
#[ allow(unused) ]
impl Config {
2019-02-05 22:17:02 +01:00
$( $(
2019-02-03 00:22:18 +01:00
pub fn $name ( & self ) -> make_config ! { @ type $ty , $none_action } {
2019-02-02 01:09:21 +01:00
self . inner . read ( ) . unwrap ( ) . config . $name . clone ( )
}
2019-02-05 22:17:02 +01:00
) + ) +
2019-02-02 01:09:21 +01:00
2019-02-03 00:22:18 +01:00
pub fn prepare_json ( & self ) -> serde_json ::Value {
2021-06-19 19:22:19 +02:00
let ( def , cfg , overriden ) = {
2019-02-03 00:22:18 +01:00
let inner = & self . inner . read ( ) . unwrap ( ) ;
2021-06-19 19:22:19 +02:00
( inner . _env . build ( ) , inner . config . clone ( ) , inner . _overrides . clone ( ) )
2019-02-03 00:22:18 +01:00
} ;
fn _get_form_type ( rust_type : & str ) -> & 'static str {
match rust_type {
2019-02-08 20:49:04 +01:00
" Pass " = > " password " ,
2019-02-03 00:22:18 +01:00
" String " = > " text " ,
" bool " = > " checkbox " ,
_ = > " number "
}
}
2019-02-02 16:47:27 +01:00
2019-02-04 01:37:25 +01:00
fn _get_doc ( doc : & str ) -> serde_json ::Value {
let mut split = doc . split ( " |> " ) . map ( str ::trim ) ;
json! ( {
" name " : split . next ( ) ,
" description " : split . next ( )
} )
}
2019-02-05 22:17:02 +01:00
json! ( [ $( {
" group " : stringify ! ( $group ) ,
2019-02-06 00:38:57 +01:00
" grouptoggle " : stringify ! ( $( $group_enabled ) ? ) ,
2019-02-05 22:17:02 +01:00
" groupdoc " : make_config ! { @ show $( $groupdoc ) ? } ,
" elements " : [
$( {
" editable " : $editable ,
" name " : stringify ! ( $name ) ,
" value " : cfg . $name ,
" default " : def . $name ,
" type " : _get_form_type ( stringify! ( $ty ) ) ,
" doc " : _get_doc ( concat! ( $( $doc ) , + ) ) ,
2021-06-19 19:22:19 +02:00
" overridden " : overriden . contains ( & stringify! ( $name ) . to_uppercase ( ) ) ,
2019-02-05 22:17:02 +01:00
} , ) +
] } , ) + ] )
2019-02-03 00:22:18 +01:00
}
2021-01-19 17:55:21 +01:00
pub fn get_support_json ( & self ) -> serde_json ::Value {
let cfg = {
let inner = & self . inner . read ( ) . unwrap ( ) ;
inner . config . clone ( )
} ;
json! ( { $( $(
stringify! ( $name ) : make_config ! { @ supportstr $name , cfg . $name , $ty , $none_action } ,
) + ) + } )
}
2021-06-19 19:22:19 +02:00
pub fn get_overrides ( & self ) -> Vec < String > {
let overrides = {
let inner = & self . inner . read ( ) . unwrap ( ) ;
inner . _overrides . clone ( )
} ;
overrides
}
2021-01-19 17:55:21 +01:00
}
} ;
// Support string print
( @ supportstr $name :ident , $value :expr , Pass , option ) = > { $value . as_ref ( ) . map ( | _ | String ::from ( " *** " ) ) } ; // Optional pass, we map to an Option<String> with "***"
( @ supportstr $name :ident , $value :expr , Pass , $none_action :ident ) = > { String ::from ( " *** " ) } ; // Required pass, we return "***"
( @ supportstr $name :ident , $value :expr , $ty :ty , option ) = > { // Optional other value, we return as is or convert to string to apply the privacy config
if PRIVACY_CONFIG . contains ( & stringify! ( $name ) ) {
json! ( $value . as_ref ( ) . map ( | x | PRIVACY_REGEX . replace_all ( & x . to_string ( ) , " ${1}* " ) . to_string ( ) ) )
} else {
json! ( $value )
2019-02-02 16:47:27 +01:00
}
} ;
2021-01-19 17:55:21 +01:00
( @ supportstr $name :ident , $value :expr , $ty :ty , $none_action :ident ) = > { // Required other value, we return as is or convert to string to apply the privacy config
if PRIVACY_CONFIG . contains ( & stringify! ( $name ) ) {
json! ( PRIVACY_REGEX . replace_all ( & $value . to_string ( ) , " ${1}* " ) . to_string ( ) )
} else {
json! ( $value )
}
} ;
2019-02-02 16:47:27 +01:00
2019-02-05 22:17:02 +01:00
// Group or empty string
( @ show ) = > { " " } ;
2019-02-06 00:38:57 +01:00
( @ show $lit :literal ) = > { $lit } ;
2019-02-05 22:17:02 +01:00
2019-02-03 00:22:18 +01:00
// Wrap the optionals in an Option type
( @ type $ty :ty , option ) = > { Option < $ty > } ;
( @ type $ty :ty , $id :ident ) = > { $ty } ;
// Generate the values depending on none_action
( @ build $value :expr , $config :expr , option , ) = > { $value } ;
( @ build $value :expr , $config :expr , def , $default :expr ) = > { $value . unwrap_or ( $default ) } ;
( @ build $value :expr , $config :expr , auto , $default_fn :expr ) = > { {
2019-02-02 16:47:27 +01:00
match $value {
2019-02-02 01:09:21 +01:00
Some ( v ) = > v ,
None = > {
2019-06-02 00:28:20 +02:00
let f : & dyn Fn ( & ConfigItems ) -> _ = & $default_fn ;
2019-02-02 16:47:27 +01:00
f ( $config )
2019-02-02 01:09:21 +01:00
}
}
2019-02-03 00:22:18 +01:00
} } ;
2019-12-27 18:42:39 +01:00
( @ build $value :expr , $config :expr , gen , $default_fn :expr ) = > { {
let f : & dyn Fn ( & ConfigItems ) -> _ = & $default_fn ;
f ( $config )
} } ;
2020-01-20 22:28:54 +01:00
( @ getenv $name :expr , bool ) = > { get_env_bool ( $name ) } ;
( @ getenv $name :expr , $ty :ident ) = > { get_env ( $name ) } ;
2019-02-02 01:09:21 +01:00
}
2019-01-25 18:23:51 +01:00
2019-02-04 01:37:25 +01:00
//STRUCTURE:
2019-02-05 22:17:02 +01:00
// /// Short description (without this they won't appear on the list)
// group {
// /// Friendly Name |> Description (Optional)
2019-12-27 18:42:39 +01:00
// name: type, is_editable, action, <default_value (Optional)>
2019-02-05 22:17:02 +01:00
// }
2019-02-04 01:37:25 +01:00
//
2019-12-27 18:42:39 +01:00
// Where action applied when the value wasn't provided and can be:
2019-02-03 00:22:18 +01:00
// def: Use a default value
// auto: Value is auto generated based on other values
// option: Value is optional
2019-12-27 18:42:39 +01:00
// gen: Value is always autogenerated and it's original value ignored
2019-02-02 01:09:21 +01:00
make_config! {
2019-02-05 22:17:02 +01:00
folders {
/// Data folder |> Main data folder
data_folder : String , false , def , " data " . to_string ( ) ;
2019-05-26 23:02:41 +02:00
/// Database URL
database_url : String , false , auto , | c | format! ( " {} / {} " , c . data_folder , " db.sqlite3 " ) ;
2020-10-06 15:23:55 +02:00
/// Database connection pool size
database_max_conns : u32 , false , def , 10 ;
2019-06-18 16:45:19 +02:00
/// Icon cache folder
2019-02-05 22:17:02 +01:00
icon_cache_folder : String , false , auto , | c | format! ( " {} / {} " , c . data_folder , " icon_cache " ) ;
/// Attachments folder
attachments_folder : String , false , auto , | c | format! ( " {} / {} " , c . data_folder , " attachments " ) ;
2021-03-14 23:35:55 +01:00
/// Sends folder
sends_folder : String , false , auto , | c | format! ( " {} / {} " , c . data_folder , " sends " ) ;
2019-02-05 22:17:02 +01:00
/// Templates folder
templates_folder : String , false , auto , | c | format! ( " {} / {} " , c . data_folder , " templates " ) ;
/// Session JWT key
rsa_key_filename : String , false , auto , | c | format! ( " {} / {} " , c . data_folder , " rsa_key " ) ;
/// Web vault folder
web_vault_folder : String , false , def , " web-vault/ " . to_string ( ) ;
2019-02-06 17:32:13 +01:00
} ,
2019-02-05 22:17:02 +01:00
ws {
/// Enable websocket notifications
websocket_enabled : bool , false , def , false ;
/// Websocket address
websocket_address : String , false , def , " 0.0.0.0 " . to_string ( ) ;
/// Websocket port
websocket_port : u16 , false , def , 3012 ;
} ,
2021-04-03 05:16:49 +02:00
jobs {
/// Job scheduler poll interval |> How often the job scheduler thread checks for jobs to run.
/// Set to 0 to globally disable scheduled jobs.
job_poll_interval_ms : u64 , false , def , 30_000 ;
/// Send purge schedule |> Cron schedule of the job that checks for Sends past their deletion date.
/// Defaults to hourly. Set blank to disable this job.
2021-04-06 08:12:36 +02:00
send_purge_schedule : String , false , def , " 0 5 * * * * " . to_string ( ) ;
2021-04-03 05:52:15 +02:00
/// Trash purge schedule |> Cron schedule of the job that checks for trashed items to delete permanently.
/// Defaults to daily. Set blank to disable this job.
2021-04-06 08:12:36 +02:00
trash_purge_schedule : String , false , def , " 0 5 0 * * * " . to_string ( ) ;
2021-04-03 05:16:49 +02:00
} ,
2019-02-06 17:32:13 +01:00
2019-02-05 22:17:02 +01:00
/// General settings
settings {
2019-03-03 16:09:15 +01:00
/// Domain URL |> This needs to be set to the URL used to access the server, including 'http[s]://'
/// and port, if it's different than the default. Some server functions don't work correctly without this value
2019-02-05 22:17:02 +01:00
domain : String , true , def , " http://localhost " . to_string ( ) ;
2019-02-18 19:25:33 +01:00
/// Domain Set |> Indicates if the domain is set by the admin. Otherwise the default will be used.
2019-02-05 22:17:02 +01:00
domain_set : bool , false , def , false ;
2020-02-19 06:27:00 +01:00
/// Domain origin |> Domain URL origin (in https://example.com:8443/path, https://example.com:8443 is the origin)
domain_origin : String , false , auto , | c | extract_url_origin ( & c . domain ) ;
/// Domain path |> Domain URL path (in https://example.com:8443/path, /path is the path)
domain_path : String , false , auto , | c | extract_url_path ( & c . domain ) ;
2019-02-05 22:17:02 +01:00
/// Enable web vault
web_vault_enabled : bool , false , def , true ;
2021-05-12 05:07:32 +02:00
/// Allow Sends |> Controls whether users are allowed to create Bitwarden Sends.
/// This setting applies globally to all users. To control this on a per-org basis instead, use the "Disable Send" org policy.
sends_allowed : bool , true , def , true ;
2019-08-20 20:07:12 +02:00
/// HIBP Api Key |> HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
2019-08-20 23:53:00 +02:00
hibp_api_key : Pass , true , option ;
2019-08-20 20:07:12 +02:00
2021-07-13 15:17:03 +02:00
/// Per-user attachment storage limit (KB) |> Max kilobytes of attachment storage allowed per user. When this limit is reached, the user will not be allowed to upload further attachments.
2020-02-17 22:56:26 +01:00
user_attachment_limit : i64 , true , option ;
2021-07-13 15:17:03 +02:00
/// Per-organization attachment storage limit (KB) |> Max kilobytes of attachment storage allowed per org. When this limit is reached, org members will not be allowed to upload further attachments for ciphers owned by that org.
2020-02-17 22:56:26 +01:00
org_attachment_limit : i64 , true , option ;
2021-04-03 05:52:15 +02:00
/// Trash auto-delete days |> Number of days to wait before auto-deleting a trashed item.
/// If unset, trashed items are not auto-deleted. This setting applies globally, so make
/// sure to inform all users of any changes to this setting.
trash_auto_delete_days : i64 , true , option ;
2019-03-03 16:09:15 +01:00
/// Disable icon downloads |> Set to true to disable icon downloading, this would still serve icons from
/// $ICON_CACHE_FOLDER, but it won't produce any external network request. Needs to set $ICON_CACHE_TTL to 0,
2019-02-05 22:17:02 +01:00
/// otherwise it will delete them and they won't be downloaded again.
disable_icon_download : bool , true , def , false ;
2021-04-27 23:18:32 +02:00
/// Allow new signups |> Controls whether new users can register. Users can be invited by the vaultwarden admin even if this is disabled
2019-02-05 22:17:02 +01:00
signups_allowed : bool , true , def , true ;
2019-11-25 06:28:49 +01:00
/// Require email verification on signups. This will prevent logins from succeeding until the address has been verified
signups_verify : bool , true , def , false ;
/// If signups require email verification, automatically re-send verification email if it hasn't been sent for a while (in seconds)
signups_verify_resend_time : u64 , true , def , 3_600 ;
/// If signups require email verification, limit how many emails are automatically sent when login is attempted (0 means no limit)
signups_verify_resend_limit : u32 , true , def , 6 ;
2020-04-09 10:42:27 +02:00
/// Email domain whitelist |> Allow signups only from this list of comma-separated domains, even when signups are otherwise disabled
2019-11-16 23:01:45 +01:00
signups_domains_whitelist : String , true , def , " " . to_string ( ) ;
2020-08-06 07:35:29 +02:00
/// Org creation users |> Allow org creation only by this list of comma-separated user emails.
/// Blank or 'all' means all users can create orgs; 'none' means no users can create orgs.
org_creation_users : String , true , def , " " . to_string ( ) ;
2020-04-09 10:42:27 +02:00
/// Allow invitations |> Controls whether users can be invited by organization admins, even when signups are otherwise disabled
2019-02-05 22:17:02 +01:00
invitations_allowed : bool , true , def , true ;
2019-03-03 16:09:15 +01:00
/// Password iterations |> Number of server-side passwords hashing iterations.
/// The changes only apply when a user changes their password. Not recommended to lower the value
2019-02-05 22:17:02 +01:00
password_iterations : i32 , true , def , 100_000 ;
2021-07-10 10:20:37 +02:00
/// Show password hint |> Controls whether a password hint should be shown directly in the web page
/// if SMTP service is not configured. Not recommended for publicly-accessible instances as this
/// provides unauthenticated access to potentially sensitive data.
show_password_hint : bool , true , def , false ;
2019-02-05 22:17:02 +01:00
/// Admin page token |> The token used to authenticate in this very same page. Changing it here won't deauthorize the current session
2019-02-08 20:49:04 +01:00
admin_token : Pass , true , option ;
2020-02-04 22:14:50 +01:00
/// Invitation organization name |> Name shown in the invitation emails that don't come from a specific organization
2021-04-27 23:18:32 +02:00
invitation_org_name : String , true , def , " Vaultwarden " . to_string ( ) ;
2019-02-05 22:17:02 +01:00
} ,
/// Advanced settings
2019-02-06 17:32:13 +01:00
advanced {
2019-12-27 18:42:39 +01:00
/// Client IP header |> If not present, the remote IP is used.
/// Set to the string "none" (without quotes), to disable any headers and just use the remote IP
ip_header : String , true , def , " X-Real-IP " . to_string ( ) ;
/// Internal IP header property, used to avoid recomputing each time
_ip_header_enabled : bool , false , gen , | c | & c . ip_header . trim ( ) . to_lowercase ( ) ! = " none " ;
2019-02-05 22:17:02 +01:00
/// Positive icon cache expiry |> Number of seconds to consider that an already cached icon is fresh. After this period, the icon will be redownloaded
icon_cache_ttl : u64 , true , def , 2_592_000 ;
/// Negative icon cache expiry |> Number of seconds before trying to download an icon that failed again.
icon_cache_negttl : u64 , true , def , 259_200 ;
2019-02-12 21:56:28 +01:00
/// Icon download timeout |> Number of seconds when to stop attempting to download an icon.
2019-03-03 16:09:15 +01:00
icon_download_timeout : u64 , true , def , 10 ;
2019-03-18 22:12:39 +01:00
/// Icon blacklist Regex |> Any domains or IPs that match this regex won't be fetched by the icon service.
/// Useful to hide other servers in the local network. Check the WIKI for more details
icon_blacklist_regex : String , true , option ;
2019-10-05 14:48:15 +02:00
/// Icon blacklist non global IPs |> Any IP which is not defined as a global IP will be blacklisted.
/// Usefull to secure your internal environment: See https://en.wikipedia.org/wiki/Reserved_IP_addresses for a list of IPs which it will block
icon_blacklist_non_global_ips : bool , true , def , true ;
2019-02-05 22:17:02 +01:00
2019-03-03 16:09:15 +01:00
/// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time.
/// Note that the checkbox would still be present, but ignored.
disable_2fa_remember : bool , true , def , false ;
2019-02-05 22:17:02 +01:00
2019-11-07 17:11:29 +01:00
/// Disable authenticator time drifted codes to be valid |> Enabling this only allows the current TOTP code to be valid
/// TOTP codes of the previous and next 30 seconds will be invalid.
2020-02-04 22:14:50 +01:00
authenticator_disable_time_drift : bool , true , def , false ;
2019-11-07 17:11:29 +01:00
2019-08-19 22:14:00 +02:00
/// Require new device emails |> When a user logs in an email is required to be sent.
/// If sending the email fails the login attempt will fail.
require_device_email : bool , true , def , false ;
2019-03-03 16:09:15 +01:00
/// Reload templates (Dev) |> When this is set to true, the templates get reloaded with every request.
/// ONLY use this during development, as it can slow down the server
2019-02-05 22:17:02 +01:00
reload_templates : bool , true , def , false ;
/// Enable extended logging
extended_logging : bool , false , def , true ;
2020-07-23 06:50:49 +02:00
/// Log timestamp format
2020-07-23 23:19:51 +02:00
log_timestamp_format : String , true , def , " %Y-%m-%d %H:%M:%S.%3f " . to_string ( ) ;
2019-03-29 20:27:20 +01:00
/// Enable the log to output to Syslog
use_syslog : bool , false , def , false ;
2019-02-05 22:17:02 +01:00
/// Log file path
log_file : String , false , option ;
2019-03-25 14:12:41 +01:00
/// Log level
log_level : String , false , def , " Info " . to_string ( ) ;
2019-02-18 11:48:48 +01:00
2021-04-27 23:18:32 +02:00
/// Enable DB WAL |> Turning this off might lead to worse performance, but might help if using vaultwarden on some exotic filesystems,
2019-03-03 16:09:15 +01:00
/// that do not support WAL. Please make sure you read project wiki on the topic before changing this setting.
2019-02-18 11:48:48 +01:00
enable_db_wal : bool , false , def , true ;
2019-02-20 21:44:35 +01:00
2020-10-03 22:31:52 +02:00
/// Max database connection retries |> Number of times to retry the database connection during startup, with 1 second between each retry, set to 0 to retry indefinitely
db_connection_retries : u32 , false , def , 15 ;
2019-10-08 19:33:27 +02:00
/// Bypass admin page security (Know the risks!) |> Disables the Admin Token for the admin page so you may use your own auth in-front
2019-02-20 21:44:35 +01:00
disable_admin_token : bool , true , def , false ;
2020-02-04 22:14:50 +01:00
/// Allowed iframe ancestors (Know the risks!) |> Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
allowed_iframe_ancestors : String , true , def , String ::new ( ) ;
2019-02-05 22:17:02 +01:00
} ,
/// Yubikey settings
2019-02-06 00:38:57 +01:00
yubico : _enable_yubico {
/// Enabled
_enable_yubico : bool , true , def , true ;
2019-02-05 22:17:02 +01:00
/// Client ID
yubico_client_id : String , true , option ;
/// Secret Key
2019-02-08 20:49:04 +01:00
yubico_secret_key : Pass , true , option ;
2019-02-05 22:17:02 +01:00
/// Server
yubico_server : String , true , option ;
} ,
2019-04-11 18:40:03 +02:00
/// Global Duo settings (Note that users can override them)
2019-04-07 18:58:15 +02:00
duo : _enable_duo {
/// Enabled
2019-04-11 18:40:03 +02:00
_enable_duo : bool , true , def , false ;
2019-04-07 18:58:15 +02:00
/// Integration Key
duo_ikey : String , true , option ;
/// Secret Key
duo_skey : Pass , true , option ;
/// Host
duo_host : String , true , option ;
2019-04-11 16:08:26 +02:00
/// Application Key (generated automatically)
_duo_akey : Pass , false , option ;
2019-04-07 18:58:15 +02:00
} ,
2019-02-05 22:17:02 +01:00
/// SMTP Email Settings
2019-02-06 00:38:57 +01:00
smtp : _enable_smtp {
/// Enabled
2020-11-18 12:07:08 +01:00
_enable_smtp : bool , true , def , true ;
2019-02-05 22:17:02 +01:00
/// Host
2020-11-18 12:07:08 +01:00
smtp_host : String , true , option ;
2020-09-19 17:09:58 +02:00
/// Enable Secure SMTP |> (Explicit) - Enabling this by default would use STARTTLS (Standard ports 587 or 25)
2020-11-18 12:07:08 +01:00
smtp_ssl : bool , true , def , true ;
2020-09-19 17:09:58 +02:00
/// Force TLS |> (Implicit) - Enabling this would force the use of an SSL/TLS connection, instead of upgrading an insecure one with STARTTLS (Standard port 465)
2020-11-18 12:07:08 +01:00
smtp_explicit_tls : bool , true , def , false ;
2019-02-05 22:17:02 +01:00
/// Port
2020-11-18 12:07:08 +01:00
smtp_port : u16 , true , auto , | c | if c . smtp_explicit_tls { 465 } else if c . smtp_ssl { 587 } else { 25 } ;
2019-02-05 22:17:02 +01:00
/// From Address
2020-11-18 12:07:08 +01:00
smtp_from : String , true , def , String ::new ( ) ;
2019-02-05 22:17:02 +01:00
/// From Name
2021-04-27 23:18:32 +02:00
smtp_from_name : String , true , def , " Vaultwarden " . to_string ( ) ;
2019-02-05 22:17:02 +01:00
/// Username
2020-11-18 12:07:08 +01:00
smtp_username : String , true , option ;
2019-02-05 22:17:02 +01:00
/// Password
2020-11-18 12:07:08 +01:00
smtp_password : Pass , true , option ;
2020-09-19 17:09:58 +02:00
/// SMTP Auth mechanism |> Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections. Possible values: ["Plain", "Login", "Xoauth2"]. Multiple options need to be separated by a comma ','.
2020-11-18 12:07:08 +01:00
smtp_auth_mechanism : String , true , option ;
2019-11-06 21:39:33 +01:00
/// SMTP connection timeout |> Number of seconds when to stop trying to connect to the SMTP server
2020-11-18 12:07:08 +01:00
smtp_timeout : u64 , true , def , 15 ;
2020-07-05 01:59:15 +02:00
/// Server name sent during HELO |> By default this value should be is on the machine's hostname, but might need to be changed in case it trips some anti-spam filters
2020-11-18 12:07:08 +01:00
helo_name : String , true , option ;
/// Enable SMTP debugging (Know the risks!) |> DANGEROUS: Enabling this will output very detailed SMTP messages. This could contain sensitive information like passwords and usernames! Only enable this during troubleshooting!
2021-06-19 19:22:19 +02:00
smtp_debug : bool , false , def , false ;
2020-11-18 12:07:08 +01:00
/// Accept Invalid Certs (Know the risks!) |> DANGEROUS: Allow invalid certificates. This option introduces significant vulnerabilities to man-in-the-middle attacks!
smtp_accept_invalid_certs : bool , true , def , false ;
/// Accept Invalid Hostnames (Know the risks!) |> DANGEROUS: Allow invalid hostnames. This option introduces significant vulnerabilities to man-in-the-middle attacks!
smtp_accept_invalid_hostnames : bool , true , def , false ;
2019-02-05 22:17:02 +01:00
} ,
2019-10-16 07:10:27 +02:00
/// Email 2FA Settings
email_2fa : _enable_email_2fa {
/// Enabled |> Disabling will prevent users from setting up new email 2FA and using existing email 2FA configured
_enable_email_2fa : bool , true , auto , | c | c . _enable_smtp & & c . smtp_host . is_some ( ) ;
2020-08-23 02:33:20 +02:00
/// Email token size |> Number of digits in an email token (min: 6, max: 19). Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting.
2019-10-16 07:10:27 +02:00
email_token_size : u32 , true , def , 6 ;
/// Token expiration time |> Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
email_expiration_time : u64 , true , def , 600 ;
/// Maximum attempts |> Maximum attempts before an email token is reset and a new email will need to be sent
email_attempts_limit : u64 , true , def , 3 ;
} ,
2019-02-02 01:09:21 +01:00
}
2019-01-25 18:23:51 +01:00
2019-02-02 16:47:27 +01:00
fn validate_config ( cfg : & ConfigItems ) -> Result < ( ) , Error > {
2020-08-18 17:15:44 +02:00
// Validate connection URL is valid and DB feature is enabled
DbConnType ::from_url ( & cfg . database_url ) ? ;
2020-03-09 22:04:03 +01:00
2020-10-06 15:23:55 +02:00
let limit = 256 ;
if cfg . database_max_conns < 1 | | cfg . database_max_conns > limit {
2021-04-06 22:54:42 +02:00
err! ( format! ( " `DATABASE_MAX_CONNS` contains an invalid value. Ensure it is between 1 and {} . " , limit , ) ) ;
2020-10-06 15:23:55 +02:00
}
2020-03-09 22:04:03 +01:00
let dom = cfg . domain . to_lowercase ( ) ;
2020-02-23 14:55:27 +01:00
if ! dom . starts_with ( " http:// " ) & & ! dom . starts_with ( " https:// " ) {
2021-01-19 17:55:21 +01:00
err! (
" DOMAIN variable needs to contain the protocol (http, https). Use 'http[s]://bw.example.com' instead of 'bw.example.com' "
) ;
2020-02-23 14:55:27 +01:00
}
2019-10-08 19:34:47 +02:00
2020-04-09 10:42:27 +02:00
let whitelist = & cfg . signups_domains_whitelist ;
if ! whitelist . is_empty ( ) & & whitelist . split ( ',' ) . any ( | d | d . trim ( ) . is_empty ( ) ) {
err! ( " `SIGNUPS_DOMAINS_WHITELIST` contains empty tokens " ) ;
}
2020-08-06 07:35:29 +02:00
let org_creation_users = cfg . org_creation_users . trim ( ) . to_lowercase ( ) ;
2021-01-19 17:55:21 +01:00
if ! ( org_creation_users . is_empty ( ) | | org_creation_users = = " all " | | org_creation_users = = " none " )
& & org_creation_users . split ( ',' ) . any ( | u | ! u . contains ( '@' ) )
{
err! ( " `ORG_CREATION_USERS` contains invalid email addresses " ) ;
2020-08-06 07:35:29 +02:00
}
2019-03-07 20:21:50 +01:00
if let Some ( ref token ) = cfg . admin_token {
2020-01-30 22:10:50 +01:00
if token . trim ( ) . is_empty ( ) & & ! cfg . disable_admin_token {
2020-04-10 05:55:08 +02:00
println! ( " [WARNING] `ADMIN_TOKEN` is enabled but has an empty value, so the admin page will be disabled. " ) ;
println! ( " [WARNING] To enable the admin page without a token, use `DISABLE_ADMIN_TOKEN`. " ) ;
2019-03-07 20:21:50 +01:00
}
}
2019-08-31 17:47:52 +02:00
if cfg . _enable_duo
& & ( cfg . duo_host . is_some ( ) | | cfg . duo_ikey . is_some ( ) | | cfg . duo_skey . is_some ( ) )
2019-04-11 16:08:26 +02:00
& & ! ( cfg . duo_host . is_some ( ) & & cfg . duo_ikey . is_some ( ) & & cfg . duo_skey . is_some ( ) )
2019-04-07 18:58:15 +02:00
{
2019-04-11 16:08:26 +02:00
err! ( " All Duo options need to be set for global Duo support " )
2019-04-07 18:58:15 +02:00
}
2019-08-31 17:47:52 +02:00
if cfg . _enable_yubico & & cfg . yubico_client_id . is_some ( ) ! = cfg . yubico_secret_key . is_some ( ) {
2019-02-02 16:47:27 +01:00
err! ( " Both `YUBICO_CLIENT_ID` and `YUBICO_SECRET_KEY` need to be set for Yubikey OTP support " )
}
2019-08-31 17:47:52 +02:00
if cfg . _enable_smtp {
if cfg . smtp_host . is_some ( ) = = cfg . smtp_from . is_empty ( ) {
err! ( " Both `SMTP_HOST` and `SMTP_FROM` need to be set for email support " )
}
2019-02-02 16:47:27 +01:00
2021-02-03 23:47:48 +01:00
if cfg . smtp_host . is_some ( ) & & ! cfg . smtp_from . contains ( '@' ) {
2021-01-31 20:07:42 +01:00
err! ( " SMTP_FROM does not contain a mandatory @ sign " )
}
2019-08-31 17:47:52 +02:00
if cfg . smtp_username . is_some ( ) ! = cfg . smtp_password . is_some ( ) {
err! ( " Both `SMTP_USERNAME` and `SMTP_PASSWORD` need to be set to enable email authentication " )
}
2019-02-02 16:47:27 +01:00
2019-08-31 17:47:52 +02:00
if cfg . _enable_email_2fa & & ( ! cfg . _enable_smtp | | cfg . smtp_host . is_none ( ) ) {
err! ( " To enable email 2FA, SMTP must be configured " )
}
if cfg . _enable_email_2fa & & cfg . email_token_size < 6 {
err! ( " `EMAIL_TOKEN_SIZE` has a minimum size of 6 " )
}
2019-08-26 20:26:54 +02:00
2019-08-31 17:47:52 +02:00
if cfg . _enable_email_2fa & & cfg . email_token_size > 19 {
err! ( " `EMAIL_TOKEN_SIZE` has a maximum size of 19 " )
}
2019-08-26 20:26:54 +02:00
}
2020-12-08 17:33:15 +01:00
// Check if the icon blacklist regex is valid
if let Some ( ref r ) = cfg . icon_blacklist_regex {
2021-06-19 22:02:03 +02:00
let validate_regex = Regex ::new ( r ) ;
2020-12-08 17:33:15 +01:00
match validate_regex {
Ok ( _ ) = > ( ) ,
Err ( e ) = > err! ( format! ( " `ICON_BLACKLIST_REGEX` is invalid: {:#?} " , e ) ) ,
}
}
2019-02-02 16:47:27 +01:00
Ok ( ( ) )
}
2020-02-19 06:27:00 +01:00
/// Extracts an RFC 6454 web origin from a URL.
fn extract_url_origin ( url : & str ) -> String {
2020-02-23 14:55:27 +01:00
match Url ::parse ( url ) {
Ok ( u ) = > u . origin ( ) . ascii_serialization ( ) ,
Err ( e ) = > {
println! ( " Error validating domain: {} " , e ) ;
String ::new ( )
}
}
2020-02-19 06:27:00 +01:00
}
/// Extracts the path from a URL.
/// All trailing '/' chars are trimmed, even if the path is a lone '/'.
fn extract_url_path ( url : & str ) -> String {
2020-02-23 14:55:27 +01:00
match Url ::parse ( url ) {
Ok ( u ) = > u . path ( ) . trim_end_matches ( '/' ) . to_string ( ) ,
Err ( _ ) = > {
// We already print it in the method above, no need to do it again
String ::new ( )
}
}
2020-02-19 06:27:00 +01:00
}
2019-02-02 01:09:21 +01:00
impl Config {
2019-02-06 00:38:57 +01:00
pub fn load ( ) -> Result < Self , Error > {
// Loading from env and file
let _env = ConfigBuilder ::from_env ( ) ;
let _usr = ConfigBuilder ::from_file ( & CONFIG_FILE ) . unwrap_or_default ( ) ;
// Create merged config, config file overwrites env
2021-06-19 19:22:19 +02:00
let mut _overrides = Vec ::new ( ) ;
let builder = _env . merge ( & _usr , true , & mut _overrides ) ;
2019-02-06 00:38:57 +01:00
// Fill any missing with defaults
let config = builder . build ( ) ;
validate_config ( & config ) ? ;
Ok ( Config {
2021-01-19 17:55:21 +01:00
inner : RwLock ::new ( Inner {
templates : load_templates ( & config . templates_folder ) ,
config ,
_env ,
_usr ,
2021-06-19 19:22:19 +02:00
_overrides ,
2021-01-19 17:55:21 +01:00
} ) ,
2019-02-06 00:38:57 +01:00
} )
}
2019-02-02 16:47:27 +01:00
pub fn update_config ( & self , other : ConfigBuilder ) -> Result < ( ) , Error > {
2019-02-03 00:22:18 +01:00
// Remove default values
2019-02-06 00:38:57 +01:00
//let builder = other.remove(&self.inner.read().unwrap()._env);
// TODO: Remove values that are defaults, above only checks those set by env and not the defaults
let builder = other ;
2019-02-02 16:47:27 +01:00
2019-02-03 00:22:18 +01:00
// Serialize now before we consume the builder
let config_str = serde_json ::to_string_pretty ( & builder ) ? ;
2019-02-02 17:45:25 +01:00
2019-02-03 00:22:18 +01:00
// Prepare the combined config
2021-06-19 19:22:19 +02:00
let mut overrides = Vec ::new ( ) ;
2019-02-03 00:22:18 +01:00
let config = {
let env = & self . inner . read ( ) . unwrap ( ) . _env ;
2021-06-19 19:22:19 +02:00
env . merge ( & builder , false , & mut overrides ) . build ( )
2019-02-03 00:22:18 +01:00
} ;
validate_config ( & config ) ? ;
// Save both the user and the combined config
{
let mut writer = self . inner . write ( ) . unwrap ( ) ;
writer . config = config ;
writer . _usr = builder ;
2021-06-19 19:22:19 +02:00
writer . _overrides = overrides ;
2019-02-03 00:22:18 +01:00
}
2019-02-02 16:47:27 +01:00
2019-02-02 17:45:25 +01:00
//Save to file
use std ::{ fs ::File , io ::Write } ;
2019-02-04 01:37:25 +01:00
let mut file = File ::create ( & * CONFIG_FILE ) ? ;
2019-02-02 17:45:25 +01:00
file . write_all ( config_str . as_bytes ( ) ) ? ;
2019-02-02 16:47:27 +01:00
Ok ( ( ) )
}
2019-04-11 16:08:26 +02:00
pub fn update_config_partial ( & self , other : ConfigBuilder ) -> Result < ( ) , Error > {
let builder = {
let usr = & self . inner . read ( ) . unwrap ( ) . _usr ;
2021-06-19 19:22:19 +02:00
let mut _overrides = Vec ::new ( ) ;
usr . merge ( & other , false , & mut _overrides )
2019-04-11 16:08:26 +02:00
} ;
self . update_config ( builder )
}
2020-05-24 23:00:26 +02:00
/// Tests whether an email's domain is allowed. A domain is allowed if it
/// is in signups_domains_whitelist, or if no whitelist is set (so there
/// are no domain restrictions in effect).
pub fn is_email_domain_allowed ( & self , email : & str ) -> bool {
2019-11-28 21:59:05 +01:00
let e : Vec < & str > = email . rsplitn ( 2 , '@' ) . collect ( ) ;
2019-11-16 23:01:45 +01:00
if e . len ( ) ! = 2 | | e [ 0 ] . is_empty ( ) | | e [ 1 ] . is_empty ( ) {
warn! ( " Failed to parse email address '{}' " , email ) ;
2019-12-27 18:37:14 +01:00
return false ;
2019-11-16 23:01:45 +01:00
}
2020-04-11 23:51:36 +02:00
let email_domain = e [ 0 ] . to_lowercase ( ) ;
2020-04-09 10:42:27 +02:00
let whitelist = self . signups_domains_whitelist ( ) ;
2020-03-09 22:04:03 +01:00
2020-05-24 23:00:26 +02:00
whitelist . is_empty ( ) | | whitelist . split ( ',' ) . any ( | d | d . trim ( ) = = email_domain )
2020-04-09 10:42:27 +02:00
}
/// Tests whether signup is allowed for an email address, taking into
/// account the signups_allowed and signups_domains_whitelist settings.
pub fn is_signup_allowed ( & self , email : & str ) -> bool {
if ! self . signups_domains_whitelist ( ) . is_empty ( ) {
// The whitelist setting overrides the signups_allowed setting.
2020-05-24 23:00:26 +02:00
self . is_email_domain_allowed ( email )
2020-04-09 10:42:27 +02:00
} else {
self . signups_allowed ( )
}
2019-11-16 23:01:45 +01:00
}
2020-08-06 07:35:29 +02:00
/// Tests whether the specified user is allowed to create an organization.
pub fn is_org_creation_allowed ( & self , email : & str ) -> bool {
let users = self . org_creation_users ( ) ;
2021-01-19 17:55:21 +01:00
if users . is_empty ( ) | | users = = " all " {
2020-08-06 07:35:29 +02:00
true
} else if users = = " none " {
false
} else {
let email = email . to_lowercase ( ) ;
users . split ( ',' ) . any ( | u | u . trim ( ) = = email )
}
}
2019-02-06 17:32:13 +01:00
pub fn delete_user_config ( & self ) -> Result < ( ) , Error > {
crate ::util ::delete_file ( & CONFIG_FILE ) ? ;
// Empty user config
let usr = ConfigBuilder ::default ( ) ;
// Config now is env + defaults
let config = {
let env = & self . inner . read ( ) . unwrap ( ) . _env ;
env . build ( )
} ;
// Save configs
{
let mut writer = self . inner . write ( ) . unwrap ( ) ;
writer . config = config ;
writer . _usr = usr ;
2021-06-19 19:22:19 +02:00
writer . _overrides = Vec ::new ( ) ;
2019-02-06 17:32:13 +01:00
}
Ok ( ( ) )
}
2019-02-03 00:22:18 +01:00
pub fn private_rsa_key ( & self ) -> String {
format! ( " {} .pem " , CONFIG . rsa_key_filename ( ) )
}
pub fn public_rsa_key ( & self ) -> String {
2021-06-25 20:49:44 +02:00
format! ( " {} .pub.pem " , CONFIG . rsa_key_filename ( ) )
2019-02-03 00:22:18 +01:00
}
2019-02-02 01:09:21 +01:00
pub fn mail_enabled ( & self ) -> bool {
2019-02-06 00:38:57 +01:00
let inner = & self . inner . read ( ) . unwrap ( ) . config ;
2019-02-06 17:32:13 +01:00
inner . _enable_smtp & & inner . smtp_host . is_some ( )
2019-02-06 00:38:57 +01:00
}
2019-04-11 16:08:26 +02:00
pub fn get_duo_akey ( & self ) -> String {
if let Some ( akey ) = self . _duo_akey ( ) {
akey
} else {
let akey = crate ::crypto ::get_random_64 ( ) ;
let akey_s = data_encoding ::BASE64 . encode ( & akey ) ;
// Save the new value
2021-01-19 17:55:21 +01:00
let builder = ConfigBuilder {
_duo_akey : Some ( akey_s . clone ( ) ) ,
.. Default ::default ( )
} ;
2019-04-11 16:08:26 +02:00
self . update_config_partial ( builder ) . ok ( ) ;
akey_s
}
2019-02-02 01:09:21 +01:00
}
2019-01-25 18:23:51 +01:00
2020-04-10 05:55:08 +02:00
/// Tests whether the admin token is set to a non-empty value.
pub fn is_admin_token_set ( & self ) -> bool {
let token = self . admin_token ( ) ;
2020-05-03 17:24:51 +02:00
token . is_some ( ) & & ! token . unwrap ( ) . trim ( ) . is_empty ( )
2020-04-10 05:55:08 +02:00
}
2019-02-02 01:09:21 +01:00
pub fn render_template < T : serde ::ser ::Serialize > (
& self ,
name : & str ,
data : & T ,
) -> Result < String , crate ::error ::Error > {
if CONFIG . reload_templates ( ) {
warn! ( " RELOADING TEMPLATES " ) ;
2020-01-26 15:29:14 +01:00
let hb = load_templates ( CONFIG . templates_folder ( ) ) ;
2019-02-02 01:09:21 +01:00
hb . render ( name , data ) . map_err ( Into ::into )
} else {
let hb = & CONFIG . inner . read ( ) . unwrap ( ) . templates ;
hb . render ( name , data ) . map_err ( Into ::into )
}
}
2019-01-25 18:23:51 +01:00
}
2020-01-26 15:29:14 +01:00
use handlebars ::{ Context , Handlebars , Helper , HelperResult , Output , RenderContext , RenderError , Renderable } ;
2019-02-03 00:22:18 +01:00
2020-01-26 15:29:14 +01:00
fn load_templates < P > ( path : P ) -> Handlebars < 'static >
where
P : AsRef < std ::path ::Path > ,
{
2019-01-25 18:23:51 +01:00
let mut hb = Handlebars ::new ( ) ;
// Error on missing params
hb . set_strict_mode ( true ) ;
2019-02-17 15:22:27 +01:00
// Register helpers
2020-01-26 15:29:14 +01:00
hb . register_helper ( " case " , Box ::new ( case_helper ) ) ;
hb . register_helper ( " jsesc " , Box ::new ( js_escape_helper ) ) ;
2019-01-25 18:23:51 +01:00
macro_rules ! reg {
( $name :expr ) = > { {
let template = include_str! ( concat! ( " static/templates/ " , $name , " .hbs " ) ) ;
hb . register_template_string ( $name , template ) . unwrap ( ) ;
} } ;
2019-02-10 19:12:34 +01:00
( $name :expr , $ext :expr ) = > { {
reg! ( $name ) ;
reg! ( concat! ( $name , $ext ) ) ;
} } ;
2019-01-25 18:23:51 +01:00
}
// First register default templates here
2021-05-08 17:46:31 +02:00
reg! ( " email/email_header " ) ;
reg! ( " email/email_footer " ) ;
reg! ( " email/email_footer_text " ) ;
2019-11-25 06:28:49 +01:00
reg! ( " email/change_email " , " .html " ) ;
reg! ( " email/delete_account " , " .html " ) ;
2019-02-10 19:12:34 +01:00
reg! ( " email/invite_accepted " , " .html " ) ;
reg! ( " email/invite_confirmed " , " .html " ) ;
2019-07-22 08:26:24 +02:00
reg! ( " email/new_device_logged_in " , " .html " ) ;
2019-02-10 19:12:34 +01:00
reg! ( " email/pw_hint_none " , " .html " ) ;
reg! ( " email/pw_hint_some " , " .html " ) ;
reg! ( " email/send_org_invite " , " .html " ) ;
2019-08-03 08:07:14 +02:00
reg! ( " email/twofactor_email " , " .html " ) ;
2019-11-25 06:28:49 +01:00
reg! ( " email/verify_email " , " .html " ) ;
reg! ( " email/welcome " , " .html " ) ;
reg! ( " email/welcome_must_verify " , " .html " ) ;
2020-02-26 11:02:22 +01:00
reg! ( " email/smtp_test " , " .html " ) ;
2019-01-25 18:23:51 +01:00
reg! ( " admin/base " ) ;
reg! ( " admin/login " ) ;
2020-05-28 10:42:36 +02:00
reg! ( " admin/settings " ) ;
reg! ( " admin/users " ) ;
reg! ( " admin/organizations " ) ;
reg! ( " admin/diagnostics " ) ;
2019-01-25 18:23:51 +01:00
// And then load user templates to overwrite the defaults
// Use .hbs extension for the files
// Templates get registered with their relative name
hb . register_templates_directory ( " .hbs " , path ) . unwrap ( ) ;
hb
}
2019-02-03 00:22:18 +01:00
2020-01-26 15:29:14 +01:00
fn case_helper < ' reg , ' rc > (
h : & Helper < ' reg , ' rc > ,
r : & ' reg Handlebars ,
ctx : & ' rc Context ,
rc : & mut RenderContext < ' reg , ' rc > ,
out : & mut dyn Output ,
) -> HelperResult {
2021-04-06 22:54:42 +02:00
let param = h . param ( 0 ) . ok_or_else ( | | RenderError ::new ( " Param not found for helper \" case \" " ) ) ? ;
2020-01-26 15:29:14 +01:00
let value = param . value ( ) . clone ( ) ;
if h . params ( ) . iter ( ) . skip ( 1 ) . any ( | x | x . value ( ) = = & value ) {
h . template ( ) . map ( | t | t . render ( r , ctx , rc , out ) ) . unwrap_or ( Ok ( ( ) ) )
} else {
Ok ( ( ) )
2019-02-03 00:22:18 +01:00
}
}
2019-02-17 15:22:27 +01:00
2020-01-26 15:29:14 +01:00
fn js_escape_helper < ' reg , ' rc > (
h : & Helper < ' reg , ' rc > ,
_r : & ' reg Handlebars ,
_ctx : & ' rc Context ,
_rc : & mut RenderContext < ' reg , ' rc > ,
out : & mut dyn Output ,
) -> HelperResult {
2021-04-06 22:54:42 +02:00
let param = h . param ( 0 ) . ok_or_else ( | | RenderError ::new ( " Param not found for helper \" js_escape \" " ) ) ? ;
2020-01-26 15:29:14 +01:00
2021-03-31 22:18:35 +02:00
let no_quote = h . param ( 1 ) . is_some ( ) ;
2021-02-03 18:43:54 +01:00
2021-04-06 22:54:42 +02:00
let value =
param . value ( ) . as_str ( ) . ok_or_else ( | | RenderError ::new ( " Param for helper \" js_escape \" is not a String " ) ) ? ;
2020-01-26 15:29:14 +01:00
2021-02-03 18:43:54 +01:00
let mut escaped_value = value . replace ( '\\' , " " ) . replace ( '\'' , " \\ x22 " ) . replace ( '\"' , " \\ x27 " ) ;
2021-03-31 22:18:35 +02:00
if ! no_quote {
2021-02-03 18:43:54 +01:00
escaped_value = format! ( " " {} " " , escaped_value ) ;
}
2020-01-26 15:29:14 +01:00
2021-02-03 18:43:54 +01:00
out . write ( & escaped_value ) ? ;
2020-01-26 15:29:14 +01:00
Ok ( ( ) )
2019-02-17 15:22:27 +01:00
}