feat: Implement a web-based account management dashboard

src/service/uiaa/mod.rs

@@ -5,9 +5,10 @@ use std::{
 };
 
 use conduwuit::{Err, Error, Result, error, utils};
+use futures::future::OptionFuture;
 use lettre::Address;
 use ruma::{
-	UserId,
+	DeviceId, UserId,
 	api::{
 		client::uiaa::{
 			AuthData, AuthFlow, AuthType, EmailIdentity, EmailUserIdentifier,
@@ -16,11 +17,19 @@ use ruma::{
 		},
 		error::{ErrorKind, StandardErrorBody},
 	},
+	assign,
+};
+use serde_json::{
+	json,
+	value::{RawValue, to_raw_value},
 };
-use serde_json::value::RawValue;
 use tokio::sync::Mutex;
 
-use crate::{Dep, config, globals, registration_tokens, threepid, users};
+use crate::{
+	Dep, config, globals,
+	oauth::{self, OAuthTicket},
+	registration_tokens, threepid, users,
+};
 
 pub struct Service {
 	services: Services,
@@ -33,6 +42,7 @@ struct Services {
 	config: Dep<config::Service>,
 	registration_tokens: Dep<registration_tokens::Service>,
 	threepid: Dep<threepid::Service>,
+	oauth: Dep<oauth::Service>,
 }
 
 impl crate::Service for Service {
@@ -45,6 +55,7 @@ impl crate::Service for Service {
 				registration_tokens: args
 					.depend::<registration_tokens::Service>("registration_tokens"),
 				threepid: args.depend::<threepid::Service>("threepid"),
+				oauth: args.depend::<oauth::Service>("oauth"),
 			},
 			uiaa_sessions: Mutex::new(HashMap::new()),
 		}))
@@ -54,8 +65,54 @@ impl crate::Service for Service {
 }
 
 struct UiaaSession {
+	session_metadata: UiaaSessionMetadata,
 	info: UiaaInfo,
-	identity: Identity,
+}
+
+#[derive(Clone)]
+enum UiaaSessionMetadata {
+	Legacy {
+		identity: Identity,
+	},
+	OAuth {
+		localpart: String,
+		ticket: OAuthTicket,
+	},
+}
+
+impl UiaaSessionMetadata {
+	fn into_identity(self) -> Identity {
+		match self {
+			| UiaaSessionMetadata::Legacy { identity } => identity,
+			| UiaaSessionMetadata::OAuth { localpart, .. } =>
+				assign!(Identity::default(), { localpart: Some(localpart) }),
+		}
+	}
+}
+
+/// Information about the user which is initiating this UIAA session.
+pub struct UiaaInitiator<'a> {
+	user_id: &'a UserId,
+	device_id: Option<&'a DeviceId>,
+	oauth_ticket: Option<OAuthTicket>,
+}
+
+impl<'a> UiaaInitiator<'a> {
+	pub fn new(user_id: &'a UserId, device_id: Option<&'a DeviceId>) -> Self {
+		Self { user_id, device_id, oauth_ticket: None }
+	}
+
+	pub fn with_oauth_ticket(
+		user_id: &'a UserId,
+		device_id: Option<&'a DeviceId>,
+		oauth_ticket: OAuthTicket,
+	) -> Self {
+		Self {
+			user_id,
+			device_id,
+			oauth_ticket: Some(oauth_ticket),
+		}
+	}
 }
 
 /// Information about the authenticated user's identity.
@@ -106,7 +163,7 @@ impl Identity {
 	/// Create an Identity with the localpart of the provided user ID
 	/// and all other fields set to None.
 	#[must_use]
-	pub fn from_user_id(user_id: &UserId) -> Self {
+	fn from_user_id(user_id: &UserId) -> Self {
 		Self {
 			localpart: Some(user_id.localpart().to_owned()),
 			..Default::default()
@@ -124,11 +181,11 @@ impl Service {
 		auth: &Option<AuthData>,
 		flows: Vec<AuthFlow>,
 		params: Box<RawValue>,
-		identity: Option<Identity>,
+		initiator: Option<UiaaInitiator<'_>>,
 	) -> Result<Identity> {
 		match auth.as_ref() {
 			| None => {
-				let info = self.create_session(flows, params, identity).await;
+				let info = self.create_session(flows, params, initiator).await?;
 
 				Err(Error::Uiaa(info))
 			},
@@ -140,8 +197,8 @@ impl Service {
 						// session if they want to start the UIAA exchange with existing
 						// authentication data. If that happens, we create a new session
 						// here.
-						self.create_session(flows, params, identity)
-							.await
+						self.create_session(flows, params, initiator)
+							.await?
 							.session
 							.unwrap()
 							.into()
@@ -161,13 +218,15 @@ impl Service {
 	pub async fn authenticate_password(
 		&self,
 		auth: &Option<AuthData>,
-		identity: Option<Identity>,
+		user_id: &UserId,
+		device_id: Option<&DeviceId>,
+		oauth_ticket: Option<OAuthTicket>,
 	) -> Result<Identity> {
 		self.authenticate(
 			auth,
 			vec![AuthFlow::new(vec![AuthType::Password])],
 			Box::default(),
-			identity,
+			Some(UiaaInitiator { user_id, device_id, oauth_ticket }),
 		)
 		.await
 	}
@@ -183,20 +242,64 @@ impl Service {
 		&self,
 		flows: Vec<AuthFlow>,
 		params: Box<RawValue>,
-		identity: Option<Identity>,
-	) -> UiaaInfo {
+		initiator: Option<UiaaInitiator<'_>>,
+	) -> Result<UiaaInfo> {
 		let mut uiaa_sessions = self.uiaa_sessions.lock().await;
 
 		let session_id = utils::random_string(Self::SESSION_ID_LENGTH);
-		let mut info = assign::assign!(UiaaInfo::new(flows), {params: Some(params)});
-		info.session = Some(session_id.clone());
 
-		uiaa_sessions.insert(session_id, UiaaSession {
-			info: info.clone(),
-			identity: identity.unwrap_or_default(),
-		});
+		let mut info = assign!(UiaaInfo::new(flows), { params: Some(params), session: Some(session_id.clone()) });
 
-		info
+		let session_metadata = if let Some(initiator) = initiator {
+			let is_oauth = OptionFuture::from(
+				initiator.device_id.map(async |device_id| {
+					self
+						.services
+						.oauth
+						.get_client_id_for_device(device_id)
+						.await
+				})
+			)
+			.await
+			.is_some();
+
+			if is_oauth {
+				if let Some(oauth_ticket) = initiator.oauth_ticket {
+					let ticket_url = self
+						.services
+						.config
+						.get_client_domain()
+						.join(&format!(
+							"{}{}",
+							conduwuit_core::ROUTE_PREFIX,
+							oauth_ticket.ticket_issue_path()
+						))
+						.unwrap();
+
+					info.flows = vec![AuthFlow::new(vec![AuthType::OAuth])];
+					info.params = Some(to_raw_value(&json!({"url": ticket_url})).unwrap());
+
+					UiaaSessionMetadata::OAuth {
+						localpart: initiator.user_id.localpart().to_owned(),
+						ticket: oauth_ticket,
+					}
+				} else {
+					return Err!(Request(Forbidden(
+						"Clients authorized with OAuth cannot use this route."
+					)));
+				}
+			} else {
+				UiaaSessionMetadata::Legacy {
+					identity: Identity::from_user_id(initiator.user_id),
+				}
+			}
+		} else {
+			UiaaSessionMetadata::Legacy { identity: Identity::default() }
+		};
+
+		uiaa_sessions.insert(session_id, UiaaSession { session_metadata, info: info.clone() });
+
+		Ok(info)
 	}
 
 	/// Proceed with UIAA authentication given a client's authorization data.
@@ -225,7 +328,7 @@ impl Service {
 		}
 
 		let completed = {
-			let UiaaSession { info, identity } = session.get_mut();
+			let UiaaSession { session_metadata, info } = session.get_mut();
 
 			let auth_type = auth.auth_type().expect("auth type should be set");
 
@@ -258,12 +361,12 @@ impl Service {
 
 			// If the provided stage hasn't already been completed, check it for completion
 			if !completed_stages.contains(auth_type.as_str()) {
-				match self.check_stage(auth, identity.clone()).await {
-					| Ok((completed_stage, updated_identity)) => {
+				match self.check_stage(auth, session_metadata.clone()).await {
+					| Ok((completed_stage, updated_metadata)) => {
 						info.auth_error = None;
 						completed_stages.insert(completed_stage.to_string());
 						info.completed.push(completed_stage);
-						*identity = updated_identity;
+						*session_metadata = updated_metadata;
 					},
 					| Err(error) => {
 						info.auth_error = Some(error);
@@ -279,9 +382,9 @@ impl Service {
 
 		if completed {
 			// This session is complete, remove it and return success
-			let (_, UiaaSession { identity, .. }) = session.remove_entry();
+			let (_, UiaaSession { session_metadata, .. }) = session.remove_entry();
 
-			Ok(Ok(identity))
+			Ok(Ok(session_metadata.into_identity()))
 		} else {
 			// The client needs to try again, return the updated session
 			Ok(Err(session.get().info.clone()))
@@ -295,152 +398,177 @@ impl Service {
 	async fn check_stage(
 		&self,
 		auth: &AuthData,
-		mut identity: Identity,
-	) -> Result<(AuthType, Identity), StandardErrorBody> {
-		// Note: This function takes ownership of `identity` because mutations to the
-		// identity must not be applied unless checking the stage succeeds. The
-		// updated identity is returned as part of the Ok value, and
-		// `continue_session` handles saving it to `uiaa_sessions`.
+		mut session_metadata: UiaaSessionMetadata,
+	) -> Result<(AuthType, UiaaSessionMetadata), StandardErrorBody> {
+		// Note: This function takes ownership of `session_metadata` because mutations
+		// to the identity (if it's a legacy session) must not be applied unless
+		// checking the stage succeeds. The updated identity is returned as part of
+		// the Ok value, and `continue_session` handles saving it to `uiaa_sessions`.
 		//
 		// This also means it's fine to mutate `identity` at any point in this function,
 		// because those mutations won't be saved unless the function returns Ok.
 
-		match auth {
-			| AuthData::Dummy(_) => Ok(AuthType::Dummy),
-			| AuthData::EmailIdentity(EmailIdentity {
-				thirdparty_id_creds: ThirdpartyIdCredentials { client_secret, sid, .. },
-				..
-			}) => {
-				match self
-					.services
-					.threepid
-					.consume_valid_session(sid, client_secret)
-					.await
-				{
-					| Ok(email) => {
-						if let Some(localpart) =
-							self.services.threepid.get_localpart_for_email(&email).await
-						{
-							identity.try_set_localpart(localpart)?;
-						}
+		let completed_auth_type = match &mut session_metadata {
+			| UiaaSessionMetadata::OAuth { localpart, ticket } => {
+				// m.oauth is the only valid stage for oauth sessions
+				assert!(
+					matches!(auth, AuthData::OAuth(_)),
+					"got non-oauth auth data for oauth session"
+				);
 
-						identity.try_set_email(email)?;
-
-						Ok(AuthType::EmailIdentity)
-					},
-					| Err(message) => Err(StandardErrorBody::new(
-						ErrorKind::ThreepidAuthFailed,
-						message.into_owned(),
-					)),
+				if self.services.oauth.try_consume_ticket(localpart, *ticket) {
+					Ok(AuthType::OAuth)
+				} else {
+					Err(StandardErrorBody::new(
+						ErrorKind::Forbidden,
+						"No OAuth ticket available".to_owned(),
+					))
 				}
 			},
-			#[allow(clippy::useless_let_if_seq)]
-			| AuthData::Password(Password { identifier, password, .. }) => {
-				let user_id_or_localpart = match identifier {
-					| UserIdentifier::Matrix(MatrixUserIdentifier { user, .. }) =>
-						user.to_owned(),
-					| UserIdentifier::Email(EmailUserIdentifier { address, .. }) => {
-						let Ok(email) = Address::try_from(address.to_owned()) else {
+			| UiaaSessionMetadata::Legacy { identity } => {
+				match auth {
+					| AuthData::Dummy(_) => Ok(AuthType::Dummy),
+					| AuthData::EmailIdentity(EmailIdentity {
+						thirdparty_id_creds: ThirdpartyIdCredentials { client_secret, sid, .. },
+						..
+					}) => {
+						match self
+							.services
+							.threepid
+							.get_valid_session(sid, client_secret)
+							.await
+						{
+							| Ok(session) => {
+								let email = session.consume();
+
+								if let Some(localpart) =
+									self.services.threepid.get_localpart_for_email(&email).await
+								{
+									identity.try_set_localpart(localpart)?;
+								}
+
+								identity.try_set_email(email)?;
+
+								Ok(AuthType::EmailIdentity)
+							},
+							| Err(message) => Err(StandardErrorBody::new(
+								ErrorKind::ThreepidAuthFailed,
+								message.into_owned(),
+							)),
+						}
+					},
+					#[allow(clippy::useless_let_if_seq)]
+					| AuthData::Password(Password { identifier, password, .. }) => {
+						let user_id_or_localpart = match identifier {
+							| UserIdentifier::Matrix(MatrixUserIdentifier { user, .. }) =>
+								user.to_owned(),
+							| UserIdentifier::Email(EmailUserIdentifier { address, .. }) => {
+								let Ok(email) = Address::try_from(address.to_owned()) else {
+									return Err(StandardErrorBody::new(
+										ErrorKind::InvalidParam,
+										"Email is malformed".to_owned(),
+									));
+								};
+
+								if let Some(localpart) =
+									self.services.threepid.get_localpart_for_email(&email).await
+								{
+									identity.try_set_email(email)?;
+
+									localpart
+								} else {
+									return Err(StandardErrorBody::new(
+										ErrorKind::Forbidden,
+										"Invalid identifier or password".to_owned(),
+									));
+								}
+							},
+							| _ =>
+								return Err(StandardErrorBody::new(
+									ErrorKind::Unrecognized,
+									"Identifier type not recognized".to_owned(),
+								)),
+						};
+
+						let Ok(user_id) = UserId::parse_with_server_name(
+							user_id_or_localpart,
+							self.services.globals.server_name(),
+						) else {
 							return Err(StandardErrorBody::new(
 								ErrorKind::InvalidParam,
-								"Email is malformed".to_owned(),
+								"User ID is malformed".to_owned(),
 							));
 						};
 
-						if let Some(localpart) =
-							self.services.threepid.get_localpart_for_email(&email).await
+						if self
+							.services
+							.users
+							.check_password(&user_id, password)
+							.await
+							.is_ok()
 						{
-							identity.try_set_email(email)?;
+							identity.try_set_localpart(user_id.localpart().to_owned())?;
 
-							localpart
+							Ok(AuthType::Password)
 						} else {
-							return Err(StandardErrorBody::new(
+							Err(StandardErrorBody::new(
 								ErrorKind::Forbidden,
 								"Invalid identifier or password".to_owned(),
-							));
+							))
 						}
 					},
-					| _ =>
-						return Err(StandardErrorBody::new(
-							ErrorKind::Unrecognized,
-							"Identifier type not recognized".to_owned(),
-						)),
-				};
+					| AuthData::ReCaptcha(ReCaptcha { response, .. }) => {
+						let Some(ref private_site_key) =
+							self.services.config.recaptcha_private_site_key
+						else {
+							return Err(StandardErrorBody::new(
+								ErrorKind::Forbidden,
+								"ReCaptcha is not configured".to_owned(),
+							));
+						};
 
-				let Ok(user_id) = UserId::parse_with_server_name(
-					user_id_or_localpart,
-					self.services.globals.server_name(),
-				) else {
-					return Err(StandardErrorBody::new(
-						ErrorKind::InvalidParam,
-						"User ID is malformed".to_owned(),
-					));
-				};
-
-				if self
-					.services
-					.users
-					.check_password(&user_id, password)
-					.await
-					.is_ok()
-				{
-					identity.try_set_localpart(user_id.localpart().to_owned())?;
-
-					Ok(AuthType::Password)
-				} else {
-					Err(StandardErrorBody::new(
-						ErrorKind::Forbidden,
-						"Invalid identifier or password".to_owned(),
-					))
-				}
-			},
-			| AuthData::ReCaptcha(ReCaptcha { response, .. }) => {
-				let Some(ref private_site_key) = self.services.config.recaptcha_private_site_key
-				else {
-					return Err(StandardErrorBody::new(
-						ErrorKind::Forbidden,
-						"ReCaptcha is not configured".to_owned(),
-					));
-				};
-
-				match recaptcha_verify::verify_v3(private_site_key, response, None).await {
-					| Ok(()) => Ok(AuthType::ReCaptcha),
-					| Err(e) => {
-						error!("ReCaptcha verification failed: {e:?}");
-						Err(StandardErrorBody::new(
-							ErrorKind::Forbidden,
-							"ReCaptcha verification failed".to_owned(),
-						))
+						match recaptcha_verify::verify_v3(private_site_key, response, None).await
+						{
+							| Ok(()) => Ok(AuthType::ReCaptcha),
+							| Err(e) => {
+								error!("ReCaptcha verification failed: {e:?}");
+								Err(StandardErrorBody::new(
+									ErrorKind::Forbidden,
+									"ReCaptcha verification failed".to_owned(),
+								))
+							},
+						}
 					},
+					| AuthData::RegistrationToken(RegistrationToken { token, .. }) => {
+						let token = token.trim().to_owned();
+
+						if let Some(valid_token) = self
+							.services
+							.registration_tokens
+							.validate_token(token)
+							.await
+						{
+							self.services
+								.registration_tokens
+								.mark_token_as_used(valid_token);
+
+							Ok(AuthType::RegistrationToken)
+						} else {
+							Err(StandardErrorBody::new(
+								ErrorKind::Forbidden,
+								"Invalid registration token".to_owned(),
+							))
+						}
+					},
+					| AuthData::Terms(_) => Ok(AuthType::Terms),
+					| _ => Err(StandardErrorBody::new(
+						ErrorKind::Unrecognized,
+						"Unsupported stage type".into(),
+					)),
 				}
 			},
-			| AuthData::RegistrationToken(RegistrationToken { token, .. }) => {
-				let token = token.trim().to_owned();
+		}?;
 
-				if let Some(valid_token) = self
-					.services
-					.registration_tokens
-					.validate_token(token)
-					.await
-				{
-					self.services
-						.registration_tokens
-						.mark_token_as_used(valid_token);
-
-					Ok(AuthType::RegistrationToken)
-				} else {
-					Err(StandardErrorBody::new(
-						ErrorKind::Forbidden,
-						"Invalid registration token".to_owned(),
-					))
-				}
-			},
-			| AuthData::Terms(_) => Ok(AuthType::Terms),
-			| _ => Err(StandardErrorBody::new(
-				ErrorKind::Unrecognized,
-				"Unsupported stage type".into(),
-			)),
-		}
-		.map(|auth_type| (auth_type, identity))
+		Ok((completed_auth_type, session_metadata))
 	}
 }