mirror of
https://github.com/hyperion-project/hyperion.ng.git
synced 2023-10-10 13:36:59 +02:00
* Push progress
TODO: rework RESET, probably to main.cpp again
* resetPassword rework
* enable administration restriction
* add short cmd for userdata
* Js apis
* Refactor JsonCB class
* Add userToken Auth
* Feat: Close connection if ext clients when def pw is set
* Feat: Protect db against pw/token tests
* WebUi PW Support (#9)
* Initial WebUi Password Support
* Small changes
* Initial WebUi Password Support
* Small changes
* Basic WebUi Token support
* added "removeStorage", added uiLock, updated login page
* Small improvments
* Small change
* Fix: prevent downgrade of authorization
* Add translation for localAdminAuth
* Feat: Show always save button in led layout
* Revert "Feat: Show always save button in led layout"
This reverts commit caad1dfcde
.
* Feat: Password change link in notification
* Fix: body padding modal overlap
* Feat: Add instance index to response on switch
* prevent schema error
Signed-off-by: Paulchen-Panther <Paulchen-Panter@protonmail.com>
* Feat: add pw save
* Feat: callout settings/pw replaced with notification
247 lines
5.8 KiB
C++
247 lines
5.8 KiB
C++
#include <hyperion/AuthManager.h>
|
|
|
|
// db
|
|
#include <db/AuthTable.h>
|
|
#include <db/MetaTable.h>
|
|
|
|
// qt
|
|
#include <QJsonObject>
|
|
#include <QTimer>
|
|
|
|
AuthManager* AuthManager::manager = nullptr;
|
|
|
|
AuthManager::AuthManager(QObject* parent)
|
|
: QObject(parent)
|
|
, _authTable(new AuthTable("",this))
|
|
, _metaTable(new MetaTable(this))
|
|
, _pendingRequests()
|
|
, _authRequired(true)
|
|
, _timer(new QTimer(this))
|
|
, _authBlockTimer(new QTimer(this))
|
|
{
|
|
AuthManager::manager = this;
|
|
|
|
|
|
// get uuid
|
|
_uuid = _metaTable->getUUID();
|
|
|
|
// setup timer
|
|
_timer->setInterval(1000);
|
|
connect(_timer, &QTimer::timeout, this, &AuthManager::checkTimeout);
|
|
|
|
// setup authBlockTimer
|
|
_authBlockTimer->setInterval(60000);
|
|
connect(_authBlockTimer, &QTimer::timeout, this, &AuthManager::checkAuthBlockTimeout);
|
|
|
|
// init with default user and password
|
|
if(!_authTable->userExist("Hyperion"))
|
|
{
|
|
_authTable->createUser("Hyperion","hyperion");
|
|
}
|
|
|
|
// update Hyperion user token on startup
|
|
_authTable->setUserToken("Hyperion");
|
|
}
|
|
|
|
const AuthManager::AuthDefinition AuthManager::createToken(const QString& comment)
|
|
{
|
|
const QString token = QUuid::createUuid().toString().mid(1, 36);
|
|
const QString id = QUuid::createUuid().toString().mid(1, 36).left(5);
|
|
|
|
_authTable->createToken(token, comment, id);
|
|
|
|
AuthDefinition def;
|
|
def.comment = comment;
|
|
def.token = token;
|
|
def.id = id;
|
|
|
|
return def;
|
|
}
|
|
|
|
const QVector<AuthManager::AuthDefinition> AuthManager::getTokenList()
|
|
{
|
|
QVector<QVariantMap> vector = _authTable->getTokenList();
|
|
QVector<AuthManager::AuthDefinition> finalVec;
|
|
for(const auto& entry : vector)
|
|
{
|
|
AuthDefinition def;
|
|
def.comment = entry["comment"].toString();
|
|
def.id = entry["id"].toString();
|
|
def.lastUse = entry["last_use"].toString();
|
|
|
|
// don't add empty ids
|
|
if(!entry["id"].toString().isEmpty())
|
|
finalVec.append(def);
|
|
}
|
|
return finalVec;
|
|
}
|
|
|
|
const QString AuthManager::getUserToken(const QString & usr)
|
|
{
|
|
return QString(_authTable->getUserToken(usr));
|
|
}
|
|
|
|
void AuthManager::setAuthBlock(const bool& user)
|
|
{
|
|
// current timestamp +10 minutes
|
|
if(user)
|
|
_userAuthAttempts.append(QDateTime::currentMSecsSinceEpoch()+600000);
|
|
else
|
|
_tokenAuthAttempts.append(QDateTime::currentMSecsSinceEpoch()+600000);
|
|
|
|
QMetaObject::invokeMethod(_authBlockTimer, "start", Qt::QueuedConnection);
|
|
}
|
|
|
|
bool AuthManager::isUserAuthorized(const QString& user, const QString& pw)
|
|
{
|
|
if(isUserAuthBlocked())
|
|
return false;
|
|
|
|
if(!_authTable->isUserAuthorized(user, pw)){
|
|
setAuthBlock(true);
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
bool AuthManager::isTokenAuthorized(const QString& token)
|
|
{
|
|
if(isTokenAuthBlocked())
|
|
return false;
|
|
|
|
if(!_authTable->tokenExist(token)){
|
|
setAuthBlock();
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
bool AuthManager::isUserTokenAuthorized(const QString& usr, const QString& token)
|
|
{
|
|
if(isUserAuthBlocked())
|
|
return false;
|
|
|
|
if(!_authTable->isUserTokenAuthorized(usr, token)){
|
|
setAuthBlock(true);
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
bool AuthManager::updateUserPassword(const QString& user, const QString& pw, const QString& newPw)
|
|
{
|
|
if(isUserAuthorized(user, pw))
|
|
return _authTable->updateUserPassword(user, newPw);
|
|
|
|
return false;
|
|
}
|
|
|
|
bool AuthManager::resetHyperionUser()
|
|
{
|
|
return _authTable->resetHyperionUser();
|
|
}
|
|
|
|
void AuthManager::setNewTokenRequest(QObject* caller, const QString& comment, const QString& id)
|
|
{
|
|
if(!_pendingRequests.contains(id))
|
|
{
|
|
AuthDefinition newDef {id, comment, caller, uint64_t(QDateTime::currentMSecsSinceEpoch()+60000)};
|
|
_pendingRequests[id] = newDef;
|
|
_timer->start();
|
|
emit newPendingTokenRequest(id, comment);
|
|
}
|
|
}
|
|
|
|
bool AuthManager::acceptTokenRequest(const QString& id)
|
|
{
|
|
if(_pendingRequests.contains(id))
|
|
{
|
|
const QString token = QUuid::createUuid().toString().remove("{").remove("}");
|
|
AuthDefinition def = _pendingRequests.take(id);
|
|
_authTable->createToken(token, def.comment, id);
|
|
emit tokenResponse(true, def.caller, token, def.comment, id);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
bool AuthManager::denyTokenRequest(const QString& id)
|
|
{
|
|
if(_pendingRequests.contains(id))
|
|
{
|
|
AuthDefinition def = _pendingRequests.take(id);
|
|
emit tokenResponse(false, def.caller, QString(), def.comment, id);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
const QMap<QString, AuthManager::AuthDefinition> AuthManager::getPendingRequests()
|
|
{
|
|
return _pendingRequests;
|
|
}
|
|
|
|
bool AuthManager::deleteToken(const QString& id)
|
|
{
|
|
if(_authTable->deleteToken(id))
|
|
{
|
|
//emit tokenDeleted(token);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
void AuthManager::handleSettingsUpdate(const settings::type& type, const QJsonDocument& config)
|
|
{
|
|
if(type == settings::NETWORK)
|
|
{
|
|
const QJsonObject& obj = config.object();
|
|
_authRequired = obj["apiAuth"].toBool(true);
|
|
_localAuthRequired = obj["localApiAuth"].toBool(false);
|
|
_localAdminAuthRequired = obj["localAdminAuth"].toBool(false);
|
|
}
|
|
}
|
|
|
|
void AuthManager::checkTimeout()
|
|
{
|
|
const uint64_t now = QDateTime::currentMSecsSinceEpoch();
|
|
|
|
QMapIterator<QString, AuthDefinition> i(_pendingRequests);
|
|
while (i.hasNext())
|
|
{
|
|
i.next();
|
|
|
|
const AuthDefinition& def = i.value();
|
|
if(def.timeoutTime <= now)
|
|
{
|
|
emit tokenResponse(false, def.caller, QString(), def.comment, def.id);
|
|
_pendingRequests.remove(i.key());
|
|
}
|
|
}
|
|
// abort if empty
|
|
if(_pendingRequests.isEmpty())
|
|
_timer->stop();
|
|
}
|
|
|
|
void AuthManager::checkAuthBlockTimeout(){
|
|
// handle user auth block
|
|
for (auto it = _userAuthAttempts.begin(); it != _userAuthAttempts.end(); it++) {
|
|
// after 10 minutes, we remove the entry
|
|
if (*it < (uint64_t)QDateTime::currentMSecsSinceEpoch()) {
|
|
_userAuthAttempts.erase(it--);
|
|
}
|
|
}
|
|
|
|
// handle token auth block
|
|
for (auto it = _tokenAuthAttempts.begin(); it != _tokenAuthAttempts.end(); it++) {
|
|
// after 10 minutes, we remove the entry
|
|
if (*it < (uint64_t)QDateTime::currentMSecsSinceEpoch()) {
|
|
_tokenAuthAttempts.erase(it--);
|
|
}
|
|
}
|
|
|
|
// if the lists are empty we stop
|
|
if(_userAuthAttempts.empty() && _tokenAuthAttempts.empty())
|
|
_authBlockTimer->stop();
|
|
}
|