Remove JS stuff from API.

2021-07-13 22:24:20 +00:00
13 changed files with 1805 additions and 0 deletions
--- a/api/Cargo.toml
+++ b/api/Cargo.toml
@ -0,0 +1,22 @@
 [package]
 name = "tenebrous-api"
 version = "0.1.0"
 authors = ["projectmoon <projectmoon@agnos.is>"]
 edition = "2018"
 [dependencies]
 log = "0.4"
 tracing-subscriber = "0.2"
 tonic = { version = "0.4" }
 prost = "0.7"
 thiserror = "1.0"
 substring = "1.4"
 jsonwebtoken = "7.2"
 chrono = "0.4"
 serde = {version = "1.0", features = ["derive"] }
 serde_json = {version = "1.0" }
 tenebrous-rpc = { path = "../rpc" }
 juniper = { git = "https://github.com/graphql-rust/juniper", branch = "master" }
 juniper_rocket_async = { git = "https://github.com/graphql-rust/juniper", branch = "master" }
 rocket = { version = "0.5.0-rc.1", features = ["json", "secrets"] }
 rocket_cors = { git = "https://github.com/lawliet89/rocket_cors", branch = "master" }
--- a/api/Rocket.toml
+++ b/api/Rocket.toml
@ -0,0 +1,10 @@
 [default]
 address = "0.0.0.0"
 port = 10000
 keep_alive = 5
 read_timeout = 5
 write_timeout = 5
 log = "normal"
 limits = { forms = 32768 }
 origins = [ "http://localhost:8000" ]
 jwt_secret = "abc123"
--- a/api/dist/app.bundle.js
+++ b/api/dist/app.bundle.js
--- a/api/dist/index.html
+++ b/api/dist/index.html
@ -0,0 +1,9 @@
 <!DOCTYPE html>
 <html>
  <head>
    <meta charset="utf-8">
    <title>Webpack App</title>
  <meta name="viewport" content="width=device-width, initial-scale=1"></head>
  <body>
  <script src="app.bundle.js"></script></body>
 </html>
--- a/api/src/api.rs
+++ b/api/src/api.rs
@ -0,0 +1,90 @@
 use crate::auth::User;
 use crate::config::create_config;
 use crate::schema::{self, Context, Schema};
 use log::info;
 use rocket::http::Method;
 use rocket::{response::content, Rocket, State};
 use rocket_cors::AllowedOrigins;
 use std::env;
 use tracing_subscriber::filter::EnvFilter;
 #[rocket::get("/")]
 fn graphiql() -> content::Html<String> {
    juniper_rocket_async::graphiql_source("/graphql", None)
 }
 #[rocket::get("/graphql?<request>")]
 async fn get_graphql_handler(
    context: &State<Context>,
    request: juniper_rocket_async::GraphQLRequest,
    schema: &State<Schema>,
 ) -> juniper_rocket_async::GraphQLResponse {
    request.execute(&*schema, &*context).await
 }
 #[rocket::post("/graphql", data = "<request>")]
 async fn post_graphql_handler(
    context: &State<Context>,
    request: juniper_rocket_async::GraphQLRequest,
    schema: &State<Schema>,
    user: User,
 ) -> juniper_rocket_async::GraphQLResponse {
    println!("User is {:?}", user);
    request.execute(&*schema, &*context).await
 }
 pub async fn run() -> Result<(), Box<dyn std::error::Error>> {
    let filter = if env::var("RUST_LOG").is_ok() {
        EnvFilter::from_default_env()
    } else {
        EnvFilter::new("tenebrous_api=info,tonic=info,rocket=info,rocket_cors=info")
    };
    tracing_subscriber::fmt().with_env_filter(filter).init();
    log::info!("Setting up gRPC connection");
    let rocket = Rocket::build();
    let config = create_config(&rocket);
    info!("Allowed CORS origins: {}", config.allowed_origins.join(","));
    //TODO move to config
    let client = tenebrous_rpc::create_client("http://localhost:9090", "abc123").await?;
    let context = Context {
        dicebot_client: client,
    };
    let schema = schema::schema();
    let allowed_origins = AllowedOrigins::some_exact(&config.allowed_origins);
    let cors = rocket_cors::CorsOptions {
        allowed_origins,
        allowed_methods: vec![Method::Get, Method::Post]
            .into_iter()
            .map(From::from)
            .collect(),
        allow_credentials: true,
        ..Default::default()
    }
    .to_cors()?;
    let routes: Vec<rocket::Route> = {
        rocket::routes![graphiql, get_graphql_handler, post_graphql_handler]
            .into_iter()
            .chain(crate::auth::routes().into_iter())
            .collect()
    };
    rocket
        .mount("/", routes)
        .attach(cors)
        .manage(context)
        .manage(schema)
        .manage(config)
        .launch()
        .await
        .expect("server to launch");
    Ok(())
 }
--- a/api/src/auth.rs
+++ b/api/src/auth.rs
@ -0,0 +1,154 @@
 use crate::config::Config;
 use crate::errors::ApiError;
 use chrono::{Duration, Utc};
 use jsonwebtoken::{decode, encode, Algorithm, DecodingKey, EncodingKey, Header, Validation};
 use rocket::response::status::Custom;
 use rocket::{http::SameSite, request::local_cache};
 use rocket::{
    http::Status,
    serde::{json::Json, Deserialize, Serialize},
 };
 use rocket::{
    http::{Cookie, CookieJar},
    outcome::Outcome,
 };
 use rocket::{
    outcome::IntoOutcome,
    request::{self, FromRequest, Request},
 };
 use rocket::{routes, Route, State};
 use substring::Substring;
 #[derive(Clone, Debug)]
 pub(crate) struct User {
    username: String, //TODO more state and such here.
 }
 fn decode_token(token: &str, config: &Config) -> Result<Claims, ApiError> {
    let token_data = decode::<Claims>(
        token,
        &DecodingKey::from_secret(config.jwt_secret.as_bytes()),
        &Validation::default(),
    )?;
    Ok(token_data.claims)
 }
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for User {
    type Error = ApiError;
    async fn from_request(req: &'r Request<'_>) -> request::Outcome<Self, Self::Error> {
        let config: Option<&Config> = req.rocket().state();
        let auth_header = req
            .headers()
            .get_one("Authorization")
            .map(|auth| auth.substring("Bearer ".len(), auth.len()));
        let token = auth_header
            .zip(config)
            .map(|(encoded_token, app_cfg)| decode_token(encoded_token, app_cfg))
            .unwrap_or(Err(ApiError::AuthenticationDenied("username".to_string())));
        match token {
            Err(e) => Outcome::Failure((Status::Forbidden, e)),
            Ok(token) => Outcome::Success(User {
                username: token.sub,
            }),
        }
    }
 }
 pub(crate) fn routes() -> Vec<Route> {
    routes![login, refresh_token]
 }
 #[derive(Debug, Serialize, Deserialize)]
 struct Claims {
    exp: usize,
    sub: String,
 }
 #[derive(Deserialize)]
 struct LoginRequest<'a> {
    username: &'a str,
    password: &'a str,
 }
 fn create_token<'a>(
    username: &str,
    expiration: Duration,
    secret: &str,
 ) -> Result<String, ApiError> {
    let expiration = Utc::now()
        .checked_add_signed(expiration)
        .expect("clock went awry")
        .timestamp();
    let claims = Claims {
        exp: expiration as usize,
        sub: username.to_owned(),
    };
    let token = encode(
        &Header::default(),
        &claims,
        &EncodingKey::from_secret(secret.as_bytes()),
    )?;
    Ok(token)
 }
 #[derive(Serialize)]
 struct LoginResponse {
    jwt_token: String,
 }
 /// A strongly-typed representation of the refresh token, used with a
 /// FromRequest trait to decode it from the cookie.
 struct RefreshToken(String);
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for RefreshToken {
    type Error = ();
    async fn from_request(request: &'r Request<'_>) -> request::Outcome<Self, Self::Error> {
        let token: Option<RefreshToken> = request
            .cookies()
            .get_private("refresh_token")
            .and_then(|cookie| cookie.value().parse::<String>().ok())
            .map(|t| RefreshToken(t));
        token.or_forward(())
    }
 }
 #[rocket::post("/login", data = "<request>")]
 async fn login(
    request: Json<LoginRequest<'_>>,
    config: &State<Config>,
    cookies: &CookieJar<'_>,
 ) -> Result<Json<LoginResponse>, ApiError> {
    let token = create_token(request.username, Duration::minutes(1), &config.jwt_secret)?;
    let refresh_token = create_token(request.username, Duration::weeks(1), &config.jwt_secret)?;
    let mut cookie = Cookie::new("refresh_token", refresh_token);
    cookie.set_same_site(SameSite::None);
    cookies.add_private(cookie);
    Ok(Json(LoginResponse { jwt_token: token }))
 }
 #[rocket::post("/refresh")]
 async fn refresh_token(
    config: &State<Config>,
    refresh_token: Option<RefreshToken>,
 ) -> Result<Json<LoginResponse>, ApiError> {
    let refresh_token = refresh_token.ok_or(ApiError::RefreshTokenMissing)?;
    let refresh_token = decode_token(&refresh_token.0, config)?;
    //TODO check if token is valid? maybe decode takes care of it.
    let token = create_token(&refresh_token.sub, Duration::minutes(1), &config.jwt_secret)?;
    Ok(Json(LoginResponse { jwt_token: token }))
 }
--- a/api/src/bin/generate_schema.rs
+++ b/api/src/bin/generate_schema.rs
@ -0,0 +1,4 @@
 use tenebrous_api::schema;
 fn main() {
    println!("{}", schema::schema().as_schema_language());
 }
--- a/api/src/config.rs
+++ b/api/src/config.rs
@ -0,0 +1,22 @@
 use rocket::{Phase, Rocket};
 /// Config values for the API service. Available as a rocket request
 /// guard.
 pub struct Config {
    /// The list of origins allowed to access the service.
    pub allowed_origins: Vec<String>,
    /// The secret key for signing JWTs.
    pub jwt_secret: String,
 }
 pub fn create_config<T: Phase>(rocket: &Rocket<T>) -> Config {
    let figment = rocket.figment();
    let allowed_origins: Vec<String> = figment.extract_inner("origins").expect("origins");
    let jwt_secret: String = figment.extract_inner("jwt_secret").expect("jwt_secret");
    Config {
        allowed_origins,
        jwt_secret,
    }
 }
--- a/api/src/errors.rs
+++ b/api/src/errors.rs
@ -0,0 +1,48 @@
 use rocket::http::ContentType;
 use rocket::response::{self, Responder, Response};
 use rocket::{http::Status, request::Request};
 use std::io::Cursor;
 use thiserror::Error;
 #[derive(Error, Debug)]
 pub enum ApiError {
    #[error("user account does not exist: {0}")]
    UserDoesNotExist(String),
    #[error("invalid password for user account: {0}")]
    AuthenticationDenied(String),
    #[error("authentication token missing from request")]
    AuthenticationRequired,
    #[error("refresh token missing from request")]
    RefreshTokenMissing,
    #[error("error decoding token: {0}")]
    TokenDecodingError(#[from] jsonwebtoken::errors::Error),
 }
 #[rocket::async_trait]
 impl<'r> Responder<'r, 'static> for ApiError {
    fn respond_to(self, _: &'r Request<'_>) -> response::Result<'static> {
        let status = match self {
            Self::UserDoesNotExist(_) => Status::Forbidden,
            Self::AuthenticationRequired => Status::Forbidden,
            Self::RefreshTokenMissing => Status::Forbidden,
            Self::AuthenticationDenied(_) => Status::Forbidden,
            Self::TokenDecodingError(_) => Status::InternalServerError,
        };
        //TODO certain errors might be too sensitive; need to filter them here.
        let body = serde_json::json!({
            "message": self.to_string()
        })
        .to_string();
        Response::build()
            .header(ContentType::JsonApi)
            .status(status)
            .sized_body(body.len(), Cursor::new(body))
            .ok()
    }
 }
--- a/api/src/grpc_web.rs
+++ b/api/src/grpc_web.rs
@ -0,0 +1,42 @@
 // use std::net::SocketAddr;
 // use tenebrous_rpc::protos::web_api::{
 //     web_api_server::{WebApi, WebApiServer},
 //     RoomsListReply, UserIdRequest,
 // };
 // use tokio::net::TcpListener;
 // use tokio_stream::wrappers::TcpListenerStream;
 // use tonic::{transport::Server, Request, Response, Status};
 //grpc-web stuff
 // struct WebApiService;
 // #[tonic::async_trait]
 // impl WebApi for WebApiService {
 //     async fn list_room(
 //         &self,
 //         request: Request<UserIdRequest>,
 //     ) -> Result<Response<RoomsListReply>, Status> {
 //         println!("Hello hopefully from a web browser");
 //         Ok(Response::new(RoomsListReply { rooms: vec![] }))
 //     }
 // }
 // #[tokio::main]
 // pub async fn grpc_web() -> Result<(), Box<dyn std::error::Error>> {
 //     let addr = SocketAddr::from(([127, 0, 0, 1], 10000));
 //     let listener = TcpListener::bind(addr).await.expect("listener");
 //     let url = format!("http://{}", listener.local_addr().unwrap());
 //     println!("Listening at {}", url);
 //     let svc = tonic_web::config()
 //         .allow_origins(vec!["http://localhost:8000"])
 //         .enable(WebApiServer::new(WebApiService));
 //     let fut = Server::builder()
 //         .accept_http1(true)
 //         .add_service(svc)
 //         .serve_with_incoming(TcpListenerStream::new(listener));
 //     fut.await?;
 //     Ok(())
 // }
--- a/api/src/lib.rs
+++ b/api/src/lib.rs
@ -0,0 +1,5 @@
 pub mod api;
 pub mod auth;
 pub mod config;
 pub mod errors;
 pub mod schema;
--- a/api/src/main.rs
+++ b/api/src/main.rs
@ -0,0 +1,5 @@
 #[rocket::main]
 pub async fn main() -> Result<(), Box<dyn std::error::Error>> {
    tenebrous_api::api::run().await?;
    Ok(())
 }
--- a/api/src/schema.rs
+++ b/api/src/schema.rs
@ -0,0 +1,117 @@
 use juniper::{
    graphql_object, EmptyMutation, EmptySubscription, FieldResult, GraphQLObject, RootNode,
 };
 use tenebrous_rpc::protos::dicebot::GetVariableRequest;
 use tenebrous_rpc::protos::dicebot::{dicebot_client::DicebotClient, UserIdRequest};
 use tonic::{transport::Channel as TonicChannel, Request as TonicRequest};
 /// Hide generic type behind alias.
 pub type DicebotGrpcClient = DicebotClient<TonicChannel>;
 /// Single room for a user.
 #[derive(GraphQLObject)]
 #[graphql(description = "A matrix room.")]
 struct Room {
    room_id: String,
    display_name: String,
 }
 /// List of rooms a user is in.
 #[derive(GraphQLObject)]
 #[graphql(description = "List of rooms a user is in.")]
 struct UserRoomList {
    user_id: String,
    rooms: Vec<Room>,
 }
 /// A single user variable in a room.
 #[derive(GraphQLObject)]
 #[graphql(description = "User variable in a room.")]
 struct UserVariable {
    room_id: String,
    user_id: String,
    variable_name: String,
    value: i32,
 }
 /// Context passed to every GraphQL function that holds stuff we need
 /// (GRPC client).
 #[derive(Clone)]
 pub struct Context {
    pub dicebot_client: DicebotGrpcClient,
 }
 /// Marker trait to make the context object usable in GraphQL.
 impl juniper::Context for Context {}
 #[derive(Clone, Copy, Debug)]
 pub struct Query;
 #[graphql_object(
   context = Context,
 )]
 impl Query {
    fn api_version() -> &str {
        "1.0"
    }
    async fn variable(
        context: &Context,
        room_id: String,
        user_id: String,
        variable: String,
    ) -> FieldResult<UserVariable> {
        let request = TonicRequest::new(GetVariableRequest {
            room_id,
            user_id,
            variable_name: variable,
        });
        let response = context
            .dicebot_client
            .clone()
            .get_variable(request)
            .await?
            .into_inner();
        Ok(UserVariable {
            user_id: response.user_id,
            room_id: response.room_id,
            variable_name: response.variable_name,
            value: response.value,
        })
    }
    async fn user_rooms(context: &Context, user_id: String) -> FieldResult<UserRoomList> {
        let request = TonicRequest::new(UserIdRequest { user_id });
        let response = context
            .dicebot_client
            .clone()
            .rooms_for_user(request)
            .await?
            .into_inner();
        Ok(UserRoomList {
            user_id: response.user_id,
            rooms: response
                .rooms
                .into_iter()
                .map(|grpc_room| Room {
                    room_id: grpc_room.room_id,
                    display_name: grpc_room.display_name,
                })
                .collect(),
        })
    }
 }
 pub type Schema = RootNode<'static, Query, EmptyMutation<Context>, EmptySubscription<Context>>;
 pub fn schema() -> Schema {
    Schema::new(
        Query,
        EmptyMutation::<Context>::new(),
        EmptySubscription::<Context>::new(),
    )
 }