authenticationrealm.cpp

/*
 * SPDX-FileCopyrightText: (C) 2013-2022 Daniel Nicoletti <dantti12@gmail.com>
 * SPDX-License-Identifier: BSD-3-Clause
 */
#include "authenticationrealm.h"
 
#include "authenticationstore.h"
#include "common.h"
#include "context.h"
#include "credentialpassword.h"
#include "storeldap.h"
 
#include <Cutelyst/Plugins/Session/session.h>
 
using namespace Cutelyst;
 
Q_LOGGING_CATEGORY(C_AUTH_REALM, "cutelyst.plugin.authentication.realm", QtWarningMsg)
 
#define SESSION_AUTHENTICATION_USER "__authentication_user"
#define SESSION_AUTHENTICATION_USER_REALM "__authentication_user_realm" // in authentication.cpp
 
AuthenticationRealm::AuthenticationRealm(std::shared_ptr<AuthenticationStore> store,
                                         std::shared_ptr<AuthenticationCredential> credential,
                                         QStringView name,
                                         QObject *parent)
    : Component(parent)
    , m_store(store)
    , m_credential(credential)
{
    m_credential->setParent(this);
 
    const QString realmName = name.toString();
    setObjectName(realmName);
    setName(realmName);
}
 
AuthenticationRealm::~AuthenticationRealm()
{
}
 
std::shared_ptr<AuthenticationStore> AuthenticationRealm::store() const noexcept
{
    return m_store;
}
 
std::shared_ptr<AuthenticationCredential> AuthenticationRealm::credential() const noexcept
{
    return m_credential;
}
 
AuthenticationUser AuthenticationRealm::findUser(Context *c, const ParamsMultiMap &userinfo)
{
    AuthenticationUser ret = m_store->findUser(c, userinfo);
 
    if (ret.isNull()) {
        if (m_store->canAutoCreateUser()) {
            ret = m_store->autoCreateUser(c, userinfo);
        }
    } else {
        if (m_store->canAutoUpdateUser()) {
            ret = m_store->autoUpdateUser(c, userinfo);
        }
    }
 
    if (!ret.isNull() && ret.authRealm() != name()) {
        ret.setAuthRealm(name());
    }
 
    return ret;
}
 
AuthenticationUser AuthenticationRealm::authenticate(Context *c, const ParamsMultiMap &authinfo)
{
    return m_credential->authenticate(c, this, authinfo);
}
 
void AuthenticationRealm::removePersistedUser(Context *c)
{
    Session::deleteValues(c,
                          {QStringLiteral(SESSION_AUTHENTICATION_USER),
                           QStringLiteral(SESSION_AUTHENTICATION_USER_REALM)});
}
 
AuthenticationUser AuthenticationRealm::persistUser(Context *c, const AuthenticationUser &user)
{
    Session::setValue(c, QStringLiteral(SESSION_AUTHENTICATION_USER), m_store->forSession(c, user));
    Session::setValue(c, QStringLiteral(SESSION_AUTHENTICATION_USER_REALM), objectName());
 
    return user;
}
 
AuthenticationUser AuthenticationRealm::restoreUser(Context *c, const QVariant &frozenUser)
{
    AuthenticationUser user;
    QVariant _frozenUser = frozenUser;
    if (_frozenUser.isNull()) {
        _frozenUser = userIsRestorable(c);
    }
 
    if (_frozenUser.isNull()) {
        return user;
    }
 
    user = m_store->fromSession(c, _frozenUser);
 
    if (!user.isNull()) {
        // Sets the realm the user originated in
        user.setAuthRealm(objectName());
    } else {
        qCWarning(C_AUTH_REALM) << "Store claimed to have a restorable user, but restoration "
                                   "failed. Did you change the user's id_field?";
    }
 
    return user;
}
 
QVariant AuthenticationRealm::userIsRestorable(Context *c)
{
    // No need to check if session is valid
    // as ::value will do that for us
    return Session::value(c, QStringLiteral(SESSION_AUTHENTICATION_USER));
}
 
bool AuthenticationRealm::checkPassword(Context *c,
                                        const AuthenticationUser &user,
                                        const QString &password,
                                        const QString &passwordField)
{
    // If the credential is CredentialPassword with LdapBind mode, delegate to store's
    // validatePassword
    auto credPassword = std::dynamic_pointer_cast<CredentialPassword>(m_credential);
    if (credPassword &&
        credPassword->passwordType() == CredentialPassword::PasswordType::SelfCheck) {
        if (m_store) {
            return m_store->validatePassword(c, user, password);
        }
        return false;
    }
    // For other password types (Hashed, Clear, None), return false (handled by credential)
    return false;
}
 
#include "moc_authenticationrealm.cpp"