VFS_sessionManager.cpp

Go to the documentation of this file.

 
#include <QRandomGenerator>
#include <QUuid>
 
#include "VFS.h"
#include "VFS_base/VFS_icons.h"
#include "VFS_datastore/VFS_hd/VFS_hd.h"
#include "VFS_session.h"
#include "utilities/rutils.h"
 
#include "VFS_sessionManager.h"
 
VFS_sessionManager::VFS_sessionManager(QString cwd, QString userdata, qint64 ttl, QString tokendata, QString developerGroup, double pruneProbability)
: VFS_node()
, _cwd(cwd)
, _userdata(userdata)
, _tokendata(tokendata)
, _ttl(ttl)
, _developerGroup(developerGroup)
, _pruneProbability(pruneProbability)
, _pruner(_tokendata)
{
        _pruneProbability = qBound(0.0,_pruneProbability,1.0);
 
        _sessions = new VFS_node();
        append("sessions",_sessions);
 
        VFS_session::initializeTypes();
}
 
VFS_sessionManager::~VFS_sessionManager()
{
}
 
 
QByteArray VFS_sessionManager::icon()
{
        return VFS_icons::get("users");
}
 
 
VFS_node *VFS_sessionManager::find(VFS_request *r)
{
        if (r->_path == "preferences.rfm")
                return this;
        else if (r->_path == "preferencesBase.rfm")
                return this;
        else if (r->_path == "tokenauth")
                return this;
        else
                return VFS_node::find(r);
}
 
 
void VFS_sessionManager::read(VFS_request *r)
{
        if (r->_path == "preferences.rfm")
        {
                VFS_session *s = r->_session;
 
                QJsonObject p;
                if (s && s->isMemberOf(_developerGroup))
                        p = rutils::jsonResource( ":/skeleton/preferencesDeveloper.rfm" );
                else
                        p = rutils::jsonResource( ":/skeleton/preferences.rfm" );
 
                r->_data.setObject(p);
                r->_success = true;
        }
        else if (r->_path == "preferencesBase.rfm")
        {
                QJsonObject p = rutils::jsonResource( ":/skeleton/preferencesBase.rfm" );
 
                r->_data.setObject(p);
                r->_success = true;
        }
        else if (r->_path == "tokenauth")
        {
                QJsonObject o = r->_data.object();
                QString token = o["authtoken"].toString("");
 
                if (token.isEmpty() || token.contains("/"))             //disallow empty tokens and those that contain a subpath. Single file names only.
                {
                        r->_reason = "No valid authtoken provided.";
                        r->_success = false;
                        return;
                }
 
                pruneTokens();
 
                VFS_request *rr = r->getCallback(this);
                rr->_path = rr->_initialPath = _tokendata+"/"+token;
                rr->_metadata["credentials"] = r->_data.object();       //tuck that away for later
                rr->_data.setObject(QJsonObject());                     //clear the data, because if it fails we don't want it going anywhere bad
                rr->_metadata["suppressError"] = true;                  //if the token isn't found, we don't want an error message
                issueRequest(rr);
        }
        else
                VFS_node::read(r);
}
 
 
void VFS_sessionManager::write(VFS_request *r)
{
        if (r->_requestType == VFS_request::create)
        {
                //VFS_websocket_client *c = dynamic_cast<VFS_websocket_client *>(r->_origin);
                        //printf("client: %p\n",c);
 
                //create and append the session
                        VFS_node *client = r->_origin;
                        QDateTime exp = (_ttl > 0 ) ? QDateTime::currentDateTimeUtc().addSecs( _ttl-1 ) : QDateTime();  //set the timeout to one second less than the expiration
 
                        QJsonObject o = r->_data.object();
 
                        //if an expiration is set in the credentials, use it
                        if (o.contains("expire"))
                                exp.setSecsSinceEpoch( o["expire"].toInt()*60 );
 
                        QString user = o["username"].toString();
                        //quint16 uidnumber = o["uidnumber"].toInt( -1 );
                        QString type = o["type"].toString();
                        QString authpath = o["authpath"].toString();
                        QString home = _userdata+"/"+user;
                        QString address = o["address"].toString();
                        QJsonObject parameters = o["parameters"].toObject();
                        QString token = o["authtoken"].toString("");
 
                        if (!_tokendata.isEmpty() && token.isEmpty())           //if we're doing authtokens but one is not present, we need to generate one.
                                token = generateAuthtoken();
 
                        if (!token.isEmpty())
                                token = _tokendata+"/"+token;
 
                        VFS_session *session = new VFS_session(client, this, user, type, home, authpath, exp, address, parameters, token);
                        // the session is appended or deleted in receiveResponse()
                        // the session is appended later to prevent subscriptions during initialization
 
//              //append last to prevent subscriptions during initialization
//                      QString sessionName = _sessions->uniqueChildName(user);
//                      if (!_sessions->append(sessionName,session))
//                      {       VFS::WARN( r->_reason = QString("Unable to append user '%1'.  Is the session name valid?").arg(user) );
//                              r->_success = false;
//                              delete session;
//                              return;
//                      }
 
                //issue the initialization request, which will issueResponse with rr
                        VFS_request *rr = r->getCallback(this);
                        session->initializeUser(rr);
 
                return;
        }
 
        VFS::WARN( r->_reason = QString("%1::write() bad?").arg(className()), 0, r->_user );
        r->_success = false;
}
 
void VFS_sessionManager::receiveResponse(VFS_request *r)
{
        //printf("VFS_sessionManager receiveResponse: %d %s\n",r->_requestType,qUtf8Printable(r->_initialPath));
 
        switch(r->_requestType)
        {
                case VFS_request::create:       {
                                                // get the session
                                                        VFS_session *session = r->_session;
                                                        if (!session)
                                                        {       //printf("No session in return from session initialization.  Gonna crash now.\n");
                                                                break;
                                                        }
 
                                                // see if the session was successfully created
                                                        if (!r->_success)
                                                        {
                                                                VFS::WARN( r->_reason = QString("Could not create a session for '%1'.  Is the home directory writable?").arg(r->_user) );
                                                                delete session;
                                                                break;
                                                        }
 
                                                // append to the vfs
                                                        QString sessionName = _sessions->uniqueChildName(r->_user);
                                                        if (!_sessions->append(sessionName,session))
                                                        {       VFS::WARN( r->_reason = QString("Unable to append session '%1'.  Is the session name valid?").arg(sessionName) );
                                                                r->_success = false;
                                                                delete session;
                                                                break;
                                                        }
 
                                                // add authtoken data
                                                        // if the sessionManager has a _tokendata path, then tokens are enabled.
                                                        // Include the token value and expiration so a browser can update its cookie.
                                                        if (!_tokendata.isEmpty())
                                                        {
                                                                QJsonObject o = r->_data.object();
                                                                //if (d.contains("authkey"))
                                                                {
                                                                        QJsonObject authtoken;
                                                                        authtoken["token"] = session->authtoken();
                                                                        authtoken["expire"] = session->secondsToExpire();
                                                                        o["authtoken"] = authtoken;
                                                                }
                                                                r->_data.setObject(o);
                                                        }
                                                }
                                                break;
 
                case VFS_request::read:         {
                                                        //if this was a token auth check
                                                        if (r->_initialPath.startsWith(_tokendata))
                                                        {
                                                                //printf("TOKEN READ: %s\n",qUtf8Printable(r->toJson(0,true,true)));
 
                                                                QJsonObject o = r->_data.object();
                                                                QJsonObject credentials = r->_metadata["credentials"].toObject();
                                                                QString token = credentials["authtoken"].toString();
 
                                                                credentials.remove("authtoken");                        // must remove here to prevent a loop
                                                                credentials.remove("expire");
                                                                r->_metadata.remove("credentials");                     // return to the pre-authtoken metadata values
 
                                                                if (!token.isEmpty() && r->_success)                    // successfully read the token, but it may be expired
                                                                {
                                                                        int now = (qint32) (QDateTime::currentDateTimeUtc().toSecsSinceEpoch()/60);
                                                                        int expire = o["expire"].toInt(0);              // if there is no expire field, zero will be used, which will cause expiration
                                                                        QString user = o["username"].toString("");      // a token data response without a username is invalid
                                                                        QString authpath = o["authpath"].toString("");  // an empty authpath is invalid
 
                                                                        /*
                                                                        if (user != r->_user)
                                                                        {
                                                                                r->_success = false;
                                                                                r->_reason = QString("Token '%1' is not for '%2'.").arg(token).arg(r->_user);
 
                                                                                if (user.isEmpty())
                                                                                        pruneTokens();
                                                                        }
                                                                        */
 
                                                                        if (user.isEmpty())
                                                                        {
                                                                                r->_success = false;
                                                                                r->_reason = QString("Invalid session data: missing user.");
                                                                        }
                                                                        else if (authpath.isEmpty())
                                                                        {
                                                                                r->_success = false;
                                                                                r->_reason = QString("Invalid session data: missing authpath.");
                                                                        }
                                                                        else if (expire < now)
                                                                        {
                                                                                r->_success = false;
                                                                                r->_reason = QString("Authtoken '%1' has expired.").arg(token);
 
                                                                                //it's expired, but we will let the pruner decide to do garbage collection
                                                                                pruneTokens();
                                                                        }
                                                                        else
                                                                        {
                                                                                //valid authtoken!
                                                                                credentials["username"] = user;
                                                                                credentials["authtoken"] = token;
                                                                                credentials["expire"] = expire;         // we will create a session with this expiration
                                                                                credentials["authpath"] = authpath;
                                                                        }
                                                                }
                                                                else
                                                                {
                                                                        r->_reason = QString("Invalid token: '%1'").arg(token);
                                                                        r->_success = false;
                                                                }
 
                                                                r->_data.setObject(credentials);                        // return the credentials
                                                        }
                                                }
                                                break;
 
                default:                        break;
        }
 
        VFS_node::receiveResponse(r);
}
 
 
QString VFS_sessionManager::getCWD()
{
        //QMutexLocker l(&_lock);
 
        return _cwd;
}
 
 
QString VFS_sessionManager::reportDetails()
{
        //return "session details here like registered types, connected users, etc.";
        return "";
}
 
QString VFS_sessionManager::generateAuthtoken()
{
        QUuid id = QUuid::createUuid();
        return id.toString(QUuid::WithoutBraces);
}
 
void VFS_sessionManager::pruneTokens()
{
        if ( !(_pruneProbability > 0.0 && QRandomGenerator::global()->bounded(1.0) < _pruneProbability ) )
                return;
 
        if (_pruner.running())
                return;
 
        _pruner.run();
}
 
 
 
VFS_sessionTokenPruner::VFS_sessionTokenPruner(QString path)
: VFS_node()
, _running(false)
, _path(path)
{
}
 
 
VFS_sessionTokenPruner::~VFS_sessionTokenPruner()
{
        stop();
}
 
 
bool VFS_sessionTokenPruner::run()
{
        if (_running) return false;
 
        VFS::LOG("Pruning tokens on '"+_path+"'...",8,"pruner");
 
        VFS_request *ls = createRequest(VFS_request::ls,_path,"pruner");
        issueRequest(ls);
 
        _running = true;
 
        return true;
}
 
 
void VFS_sessionTokenPruner::stop()
{
        _running = false;
        _pathList.clear();
}
 
 
bool VFS_sessionTokenPruner::running()
{
        return _running;
}
 
 
void VFS_sessionTokenPruner::receiveResponse(VFS_request *r)
{
        if (!r->_success)
        {
                VFS::ERROR("Prune failed on '"+r->_initialPath+"'",0,"pruner");
                stop();
        }
        else
        {
                switch(r->_requestType)
                {
                        case VFS_request::ls:   {
                                                        //printf("Pruner LS: %s\n",qUtf8Printable(r->toJson(0,true,true)));
                                                        QJsonObject o = r->_data.object();
                                                        _pathList = o.keys();
 
                                                        peel();
                                                }
                                                break;
 
                        case VFS_request::read: {
                                                        //printf("Pruner Read: %s\n",qUtf8Printable(r->toJson(0,true,true)));
                                                        QJsonObject o = r->_data.object();
                                                        if (!checkEntry(o))
                                                                peel();
                                                        else
                                                                pruneEntry(r->_initialPath);
                                                }
                                                break;
 
                        case VFS_request::rm:   {
                                                        //printf("Pruner RM: %s\n",qUtf8Printable(r->toJson(0,true,true)));
                                                        peel();
                                                }
                                                break;
 
                        default:                break;
                }
        }
 
        VFS_node::receiveResponse(r);
}
 
void VFS_sessionTokenPruner::peel()
{
        if (_pathList.length())
        {
                QString p = _path+"/"+_pathList.takeFirst();
                VFS::LOG( QString("  Pruner checking: %1\n").arg(qUtf8Printable(p)),8,"pruner");
                VFS_request *r = createRequest(VFS_request::read,p,"pruner");
                r->_metadata["cache"] = false;          //don't blow out our cache by reading all tokens
                issueRequest(r);
        }
        else
                stop();
}
 
bool VFS_sessionTokenPruner::checkEntry(QJsonObject o)
{
        if ( o["username"].toString("").isEmpty() )     return false;
        if ( o["authpath"].toString("").isEmpty() )     return false;
 
        int now = (qint32) (QDateTime::currentDateTimeUtc().toSecsSinceEpoch()/60);
 
        if ( o["expire"].toInt(0) > now )               return false;
 
        return true;
}
 
void VFS_sessionTokenPruner::pruneEntry(QString p)
{
        VFS::WARN( QString("  Pruner pruning: %1\n").arg(qUtf8Printable(p)),8,"pruner");
        VFS_request *r = createRequest(VFS_request::rm,p,"pruner");
        r->_metadata["cache"] = false;          //don't blow out our cache reading tokens
        issueRequest(r);
}