1
0
Fork 0
vaultwarden-test/src/api/core/accounts.rs

306 Zeilen
7,6 KiB
Rust

use rocket_contrib::Json;
2018-02-10 01:00:55 +01:00
use db::DbConn;
use db::models::*;
use api::{PasswordData, JsonResult, EmptyResult, JsonUpcase, NumberOrString};
2018-02-10 01:00:55 +01:00
use auth::Headers;
use CONFIG;
#[derive(Deserialize, Debug)]
#[allow(non_snake_case)]
struct RegisterData {
Email: String,
Key: String,
Keys: Option<KeysData>,
MasterPasswordHash: String,
MasterPasswordHint: Option<String>,
Name: Option<String>,
2018-02-10 01:00:55 +01:00
}
#[derive(Deserialize, Debug)]
#[allow(non_snake_case)]
struct KeysData {
2018-06-01 00:35:30 +02:00
EncryptedPrivateKey: String,
PublicKey: String,
2018-02-10 01:00:55 +01:00
}
#[post("/accounts/register", data = "<data>")]
fn register(data: JsonUpcase<RegisterData>, conn: DbConn) -> EmptyResult {
let data: RegisterData = data.into_inner().data;
2018-02-17 23:38:55 +01:00
if !CONFIG.signups_allowed {
err!("Signups not allowed")
2018-02-10 01:00:55 +01:00
}
if User::find_by_mail(&data.Email, &conn).is_some() {
2018-02-10 01:00:55 +01:00
err!("Email already exists")
}
let mut user = User::new(data.Email, data.Key, data.MasterPasswordHash);
2018-02-10 01:00:55 +01:00
// Add extra fields if present
if let Some(name) = data.Name {
2018-02-10 01:00:55 +01:00
user.name = name;
}
if let Some(hint) = data.MasterPasswordHint {
2018-02-10 01:00:55 +01:00
user.password_hint = Some(hint);
}
if let Some(keys) = data.Keys {
2018-06-01 00:35:30 +02:00
user.private_key = Some(keys.EncryptedPrivateKey);
user.public_key = Some(keys.PublicKey);
2018-02-10 01:00:55 +01:00
}
user.save(&conn);
Ok(())
}
#[get("/accounts/profile")]
fn profile(headers: Headers, conn: DbConn) -> JsonResult {
Ok(Json(headers.user.to_json(&conn)))
}
#[derive(Deserialize, Debug)]
#[allow(non_snake_case)]
struct ProfileData {
#[serde(rename = "Culture")]
_Culture: String, // Ignored, always use en-US
MasterPasswordHint: Option<String>,
Name: String,
}
2018-08-15 17:10:40 +02:00
#[put("/accounts/profile", data = "<data>")]
fn put_profile(data: JsonUpcase<ProfileData>, headers: Headers, conn: DbConn) -> JsonResult {
post_profile(data, headers, conn)
}
#[post("/accounts/profile", data = "<data>")]
fn post_profile(data: JsonUpcase<ProfileData>, headers: Headers, conn: DbConn) -> JsonResult {
let data: ProfileData = data.into_inner().data;
let mut user = headers.user;
user.name = data.Name;
user.password_hint = data.MasterPasswordHint;
user.save(&conn);
Ok(Json(user.to_json(&conn)))
}
#[get("/users/<uuid>/public-key")]
fn get_public_keys(uuid: String, _headers: Headers, conn: DbConn) -> JsonResult {
let user = match User::find_by_uuid(&uuid, &conn) {
Some(user) => user,
None => err!("User doesn't exist")
};
Ok(Json(json!({
"UserId": user.uuid,
"PublicKey": user.public_key,
"Object":"userKey"
})))
2018-02-10 01:00:55 +01:00
}
#[post("/accounts/keys", data = "<data>")]
fn post_keys(data: JsonUpcase<KeysData>, headers: Headers, conn: DbConn) -> JsonResult {
let data: KeysData = data.into_inner().data;
2018-02-17 23:38:55 +01:00
2018-02-10 01:00:55 +01:00
let mut user = headers.user;
2018-06-01 00:35:30 +02:00
user.private_key = Some(data.EncryptedPrivateKey);
user.public_key = Some(data.PublicKey);
2018-02-10 01:00:55 +01:00
user.save(&conn);
Ok(Json(user.to_json(&conn)))
2018-02-10 01:00:55 +01:00
}
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct ChangePassData {
MasterPasswordHash: String,
NewMasterPasswordHash: String,
Key: String,
}
2018-02-10 01:00:55 +01:00
#[post("/accounts/password", data = "<data>")]
fn post_password(data: JsonUpcase<ChangePassData>, headers: Headers, conn: DbConn) -> EmptyResult {
let data: ChangePassData = data.into_inner().data;
2018-02-10 01:00:55 +01:00
let mut user = headers.user;
if !user.check_valid_password(&data.MasterPasswordHash) {
2018-02-10 01:00:55 +01:00
err!("Invalid password")
}
user.set_password(&data.NewMasterPasswordHash);
user.key = data.Key;
2018-02-10 01:00:55 +01:00
user.save(&conn);
Ok(())
2018-02-10 01:00:55 +01:00
}
#[post("/accounts/security-stamp", data = "<data>")]
fn post_sstamp(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> EmptyResult {
let data: PasswordData = data.into_inner().data;
2018-02-10 01:00:55 +01:00
let mut user = headers.user;
if !user.check_valid_password(&data.MasterPasswordHash) {
2018-02-10 01:00:55 +01:00
err!("Invalid password")
}
user.reset_security_stamp();
user.save(&conn);
2018-02-10 01:00:55 +01:00
Ok(())
2018-02-10 01:00:55 +01:00
}
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct EmailTokenData {
MasterPasswordHash: String,
NewEmail: String,
}
2018-02-10 01:00:55 +01:00
#[post("/accounts/email-token", data = "<data>")]
fn post_email_token(data: JsonUpcase<EmailTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
let data: EmailTokenData = data.into_inner().data;
if !headers.user.check_valid_password(&data.MasterPasswordHash) {
err!("Invalid password")
}
if User::find_by_mail(&data.NewEmail, &conn).is_some() {
err!("Email already in use");
}
Ok(())
}
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct ChangeEmailData {
MasterPasswordHash: String,
NewEmail: String,
Key: String,
NewMasterPasswordHash: String,
#[serde(rename = "Token")]
_Token: NumberOrString,
}
#[post("/accounts/email", data = "<data>")]
fn post_email(data: JsonUpcase<ChangeEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
let data: ChangeEmailData = data.into_inner().data;
2018-02-10 01:00:55 +01:00
let mut user = headers.user;
if !user.check_valid_password(&data.MasterPasswordHash) {
2018-02-10 01:00:55 +01:00
err!("Invalid password")
}
if User::find_by_mail(&data.NewEmail, &conn).is_some() {
err!("Email already in use");
}
user.email = data.NewEmail;
user.set_password(&data.NewMasterPasswordHash);
user.key = data.Key;
user.save(&conn);
Ok(())
2018-02-10 01:00:55 +01:00
}
#[post("/accounts/delete", data = "<data>")]
fn delete_account(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> EmptyResult {
let data: PasswordData = data.into_inner().data;
2018-02-15 00:53:11 +01:00
let user = headers.user;
2018-02-10 01:00:55 +01:00
if !user.check_valid_password(&data.MasterPasswordHash) {
2018-02-10 01:00:55 +01:00
err!("Invalid password")
}
// Delete ciphers and their attachments
for cipher in Cipher::find_owned_by_user(&user.uuid, &conn) {
if cipher.delete(&conn).is_err() {
err!("Failed deleting cipher")
}
}
// Delete folders
for f in Folder::find_by_user(&user.uuid, &conn) {
if f.delete(&conn).is_err() {
err!("Failed deleting folder")
}
}
// Delete devices
for d in Device::find_by_user(&user.uuid, &conn) { d.delete(&conn); }
// Delete user
user.delete(&conn);
Ok(())
2018-02-10 01:00:55 +01:00
}
#[get("/accounts/revision-date")]
fn revision_date(headers: Headers) -> String {
let revision_date = headers.user.updated_at.timestamp_millis();
revision_date.to_string()
2018-02-10 01:00:55 +01:00
}
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct PasswordHintData {
Email: String,
}
#[post("/accounts/password-hint", data = "<data>")]
fn password_hint(data: JsonUpcase<PasswordHintData>, conn: DbConn) -> EmptyResult {
let data: PasswordHintData = data.into_inner().data;
if !CONFIG.show_password_hint {
return Ok(())
}
match User::find_by_mail(&data.Email, &conn) {
Some(user) => {
let hint = user.password_hint.to_owned().unwrap_or_default();
err!(format!("Your password hint is: {}", hint))
},
None => Ok(()),
}
}
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct PreloginData {
Email: String,
}
#[post("/accounts/prelogin", data = "<data>")]
fn prelogin(data: JsonUpcase<PreloginData>, conn: DbConn) -> JsonResult {
let data: PreloginData = data.into_inner().data;
match User::find_by_mail(&data.Email, &conn) {
Some(user) => {
let kdf_type = 0; // PBKDF2: 0
let _server_iter = user.password_iterations;
let client_iter = 5000; // TODO: Make iterations user configurable
Ok(Json(json!({
"Kdf": kdf_type,
"KdfIterations": client_iter
})))
},
None => err!("Invalid user"),
}
}