diff --git a/.gitignore b/.gitignore index 7cd509b..060148d 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ Cargo.lock # option (not recommended) you can uncomment the following to ignore the entire idea folder. #.idea/ /config.toml +/key.pem diff --git a/Cargo.toml b/Cargo.toml index 30b5827..7ac8754 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -45,6 +45,7 @@ thiserror = "2.0.12" actix-multipart = "0.7.2" lettre = { version = "0.11.16", features = ["tokio1", "tokio1-native-tls"] } chrono = { version = "0.4.41", features = ["serde"] } +ed25519-dalek = { version = "2.1.1", features = ["pem", "pkcs8", "rand_core"] } [dependencies.tokio] version = "1.45" diff --git a/entrypoint.sh b/entrypoint.sh index 38ba890..98729db 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -65,4 +65,4 @@ rotate_log "/gorb/logs/backend.log" # Give the DB time to start up before connecting sleep 5 -/usr/bin/gorb-backend --config /gorb/config/config.toml 2>&1 | tee /gorb/logs/backend.log +/usr/bin/gorb-backend --config /gorb/config/config.toml --private-key /gorb/config/federation-privkey.pem 2>&1 | tee /gorb/logs/backend.log diff --git a/migrations/2025-06-03-123458_federated_instances/down.sql b/migrations/2025-06-03-123458_federated_instances/down.sql new file mode 100644 index 0000000..b9ca2c0 --- /dev/null +++ b/migrations/2025-06-03-123458_federated_instances/down.sql @@ -0,0 +1,3 @@ +-- This file should undo anything in `up.sql` +DROP TABLE federated_users; +DROP TABLE instances; diff --git a/migrations/2025-06-03-123458_federated_instances/up.sql b/migrations/2025-06-03-123458_federated_instances/up.sql new file mode 100644 index 0000000..4113798 --- /dev/null +++ b/migrations/2025-06-03-123458_federated_instances/up.sql @@ -0,0 +1,10 @@ +-- Your SQL goes here +CREATE TABLE instances ( + instance_url VARCHAR(8000) PRIMARY KEY NOT NULL, + public_key VARCHAR(500) UNIQUE NOT NULL +); + +CREATE TABLE federated_users ( + uuid UUID PRIMARY KEY NOT NULL, + instance_url VARCHAR(8000) NOT NULL REFERENCES instances(instance_url) +); diff --git a/migrations/2025-06-06-145916_guild_ownership_changes/down.sql b/migrations/2025-06-06-145916_guild_ownership_changes/down.sql deleted file mode 100644 index 21a08c9..0000000 --- a/migrations/2025-06-06-145916_guild_ownership_changes/down.sql +++ /dev/null @@ -1,14 +0,0 @@ --- This file should undo anything in `up.sql` -ALTER TABLE guilds -ADD COLUMN owner_uuid UUID REFERENCES users(uuid); - -UPDATE guilds g -SET owner_uuid = gm.user_uuid -FROM guild_members gm -WHERE gm.guild_uuid = g.uuid AND gm.is_owner = TRUE; - -ALTER TABLE guilds -ALTER COLUMN owner_uuid SET NOT NULL; - -ALTER TABLE guild_members -DROP COLUMN is_owner; diff --git a/migrations/2025-06-06-145916_guild_ownership_changes/up.sql b/migrations/2025-06-06-145916_guild_ownership_changes/up.sql deleted file mode 100644 index b94323f..0000000 --- a/migrations/2025-06-06-145916_guild_ownership_changes/up.sql +++ /dev/null @@ -1,14 +0,0 @@ --- Your SQL goes here -ALTER TABLE guild_members -ADD COLUMN is_owner BOOLEAN NOT NULL DEFAULT false; - -UPDATE guild_members gm -SET is_owner = true -FROM guilds g -WHERE gm.guild_uuid = g.uuid AND gm.user_uuid = g.owner_uuid; - -CREATE UNIQUE INDEX one_owner_per_guild ON guild_members (guild_uuid) -WHERE is_owner; - -ALTER TABLE guilds -DROP COLUMN owner_uuid; diff --git a/src/api/v1/channels/uuid/mod.rs b/src/api/v1/channels/uuid/mod.rs index bece6ed..1cb20c7 100644 --- a/src/api/v1/channels/uuid/mod.rs +++ b/src/api/v1/channels/uuid/mod.rs @@ -4,7 +4,11 @@ pub mod messages; pub mod socket; use crate::{ - api::v1::auth::check_access_token, error::Error, objects::{Channel, Member, Permissions}, utils::{get_auth_header, global_checks}, Data + Data, + api::v1::auth::check_access_token, + error::Error, + objects::{Channel, Member}, + utils::{get_auth_header, global_checks}, }; use actix_web::{HttpRequest, HttpResponse, delete, get, patch, web}; use serde::Deserialize; @@ -55,9 +59,7 @@ pub async fn delete( let channel = Channel::fetch_one(&data, channel_uuid).await?; - let member = Member::check_membership(&mut conn, uuid, channel.guild_uuid).await?; - - member.check_permission(&data, Permissions::DeleteChannel).await?; + Member::check_membership(&mut conn, uuid, channel.guild_uuid).await?; channel.delete(&data).await?; @@ -123,9 +125,7 @@ pub async fn patch( let mut channel = Channel::fetch_one(&data, channel_uuid).await?; - let member = Member::check_membership(&mut conn, uuid, channel.guild_uuid).await?; - - member.check_permission(&data, Permissions::ManageChannel).await?; + Member::check_membership(&mut conn, uuid, channel.guild_uuid).await?; if let Some(new_name) = &new_info.name { channel.set_name(&data, new_name.to_string()).await?; diff --git a/src/api/v1/federation/mod.rs b/src/api/v1/federation/mod.rs new file mode 100644 index 0000000..16901d4 --- /dev/null +++ b/src/api/v1/federation/mod.rs @@ -0,0 +1,44 @@ +use actix_web::{post, web, HttpRequest, Scope}; + +use crate::{objects::Signature, Data}; + +mod pubkey; + +pub fn web() -> Scope { + web::scope("/federation") + .service(pubkey::get) + .service(post) +} + +#[post("")] +pub async fn post( + req: HttpRequest, + channel_info: web::Json<>, + data: web::Data, +) -> Result { + let headers = req.headers(); + + let signature = Signature::from_signature_header(headers)?; + + let guild_uuid = path.into_inner().0; + + let mut conn = data.pool.get().await?; + + let uuid = check_access_token(auth_header, &mut conn).await?; + + global_checks(&data, uuid).await?; + + Member::check_membership(&mut conn, uuid, guild_uuid).await?; + + // FIXME: Logic to check permissions, should probably be done in utils.rs + + let channel = Channel::new( + data.clone(), + guild_uuid, + channel_info.name.clone(), + channel_info.description.clone(), + ) + .await?; + + Ok(HttpResponse::Ok().json(channel)) +} diff --git a/src/api/v1/federation/pubkey.rs b/src/api/v1/federation/pubkey.rs new file mode 100644 index 0000000..3ce9f8d --- /dev/null +++ b/src/api/v1/federation/pubkey.rs @@ -0,0 +1,29 @@ +//! `/api/v1/users/{uuid}` Specific user endpoints + +use actix_web::{HttpResponse, get, web}; +use ed25519_dalek::pkcs8::{spki::der::pem::LineEnding, EncodePublicKey}; + +use crate::{ + Data, + error::Error, +}; + +/// `GET /api/v1/users/{uuid}` Returns user with the given UUID +/// +/// requires auth: yes +/// +/// requires relation: yes +/// +/// ### Response Example +/// ``` +/// "" +/// ``` +/// NOTE: UUIDs in this response are made using `uuidgen`, UUIDs made by the actual backend will be UUIDv7 and have extractable timestamps +#[get("/pubkey")] +pub async fn get( + data: web::Data, +) -> Result { + let pubkey = data.signing_key.verifying_key().to_public_key_pem(LineEnding::LF)?; + + Ok(HttpResponse::Ok().body(pubkey)) +} diff --git a/src/api/v1/guilds/uuid/channels.rs b/src/api/v1/guilds/uuid/channels.rs index db895e4..083553a 100644 --- a/src/api/v1/guilds/uuid/channels.rs +++ b/src/api/v1/guilds/uuid/channels.rs @@ -1,5 +1,9 @@ use crate::{ - api::v1::auth::check_access_token, error::Error, objects::{Channel, Member, Permissions}, utils::{get_auth_header, global_checks, order_by_is_above}, Data + Data, + api::v1::auth::check_access_token, + error::Error, + objects::{Channel, Member}, + utils::{get_auth_header, global_checks, order_by_is_above}, }; use ::uuid::Uuid; use actix_web::{HttpRequest, HttpResponse, get, post, web}; @@ -70,9 +74,9 @@ pub async fn create( global_checks(&data, uuid).await?; - let member = Member::check_membership(&mut conn, uuid, guild_uuid).await?; + Member::check_membership(&mut conn, uuid, guild_uuid).await?; - member.check_permission(&data, Permissions::CreateChannel).await?; + // FIXME: Logic to check permissions, should probably be done in utils.rs let channel = Channel::new( data.clone(), diff --git a/src/api/v1/guilds/uuid/icon.rs b/src/api/v1/guilds/uuid/icon.rs index 4061585..5025416 100644 --- a/src/api/v1/guilds/uuid/icon.rs +++ b/src/api/v1/guilds/uuid/icon.rs @@ -5,7 +5,11 @@ use futures_util::StreamExt as _; use uuid::Uuid; use crate::{ - api::v1::auth::check_access_token, error::Error, objects::{Guild, Member, Permissions}, utils::{get_auth_header, global_checks}, Data + Data, + api::v1::auth::check_access_token, + error::Error, + objects::{Guild, Member}, + utils::{get_auth_header, global_checks}, }; /// `PUT /api/v1/guilds/{uuid}/icon` Icon upload @@ -32,9 +36,7 @@ pub async fn upload( global_checks(&data, uuid).await?; - let member = Member::check_membership(&mut conn, uuid, guild_uuid).await?; - - member.check_permission(&data, Permissions::ManageServer).await?; + Member::check_membership(&mut conn, uuid, guild_uuid).await?; let mut guild = Guild::fetch_one(&mut conn, guild_uuid).await?; diff --git a/src/api/v1/guilds/uuid/invites/mod.rs b/src/api/v1/guilds/uuid/invites/mod.rs index eb8d2ce..bb8269c 100644 --- a/src/api/v1/guilds/uuid/invites/mod.rs +++ b/src/api/v1/guilds/uuid/invites/mod.rs @@ -3,7 +3,11 @@ use serde::Deserialize; use uuid::Uuid; use crate::{ - api::v1::auth::check_access_token, error::Error, objects::{Guild, Member, Permissions}, utils::{get_auth_header, global_checks}, Data + Data, + api::v1::auth::check_access_token, + error::Error, + objects::{Guild, Member}, + utils::{get_auth_header, global_checks}, }; #[derive(Deserialize)] @@ -57,9 +61,7 @@ pub async fn create( global_checks(&data, uuid).await?; - let member = Member::check_membership(&mut conn, uuid, guild_uuid).await?; - - member.check_permission(&data, Permissions::CreateInvite).await?; + Member::check_membership(&mut conn, uuid, guild_uuid).await?; let guild = Guild::fetch_one(&mut conn, guild_uuid).await?; diff --git a/src/api/v1/guilds/uuid/roles/mod.rs b/src/api/v1/guilds/uuid/roles/mod.rs index c33f144..717b30b 100644 --- a/src/api/v1/guilds/uuid/roles/mod.rs +++ b/src/api/v1/guilds/uuid/roles/mod.rs @@ -3,7 +3,11 @@ use actix_web::{HttpRequest, HttpResponse, get, post, web}; use serde::Deserialize; use crate::{ - api::v1::auth::check_access_token, error::Error, objects::{Member, Permissions, Role}, utils::{get_auth_header, global_checks, order_by_is_above}, Data + Data, + api::v1::auth::check_access_token, + error::Error, + objects::{Member, Role}, + utils::{get_auth_header, global_checks, order_by_is_above}, }; pub mod uuid; @@ -66,9 +70,9 @@ pub async fn create( global_checks(&data, uuid).await?; - let member = Member::check_membership(&mut conn, uuid, guild_uuid).await?; + Member::check_membership(&mut conn, uuid, guild_uuid).await?; - member.check_permission(&data, Permissions::CreateRole).await?; + // FIXME: Logic to check permissions, should probably be done in utils.rs let role = Role::new(&mut conn, guild_uuid, role_info.name.clone()).await?; diff --git a/src/api/v1/mod.rs b/src/api/v1/mod.rs index 6c2df0b..9422fe4 100644 --- a/src/api/v1/mod.rs +++ b/src/api/v1/mod.rs @@ -9,6 +9,7 @@ mod invites; mod me; mod stats; mod users; +mod federation; pub fn web() -> Scope { web::scope("/v1") @@ -19,4 +20,5 @@ pub fn web() -> Scope { .service(guilds::web()) .service(invites::web()) .service(me::web()) + .service(federation::web()) } diff --git a/src/error.rs b/src/error.rs index 1b1bfba..860400c 100644 --- a/src/error.rs +++ b/src/error.rs @@ -12,6 +12,7 @@ use bunny_api_tokio::error::Error as BunnyError; use deadpool::managed::{BuildError, PoolError}; use diesel::{ConnectionError, result::Error as DieselError}; use diesel_async::pooled_connection::PoolError as DieselPoolError; +use ed25519_dalek::pkcs8::{self, spki}; use lettre::{ address::AddressError, error::Error as EmailError, transport::smtp::Error as SmtpError, }; @@ -63,6 +64,10 @@ pub enum Error { SmtpError(#[from] SmtpError), #[error(transparent)] SmtpAddressError(#[from] AddressError), + #[error(transparent)] + Pkcs8Error(#[from] pkcs8::Error), + #[error(transparent)] + SpkiError(#[from] spki::Error), #[error("{0}")] PasswordHashError(String), #[error("{0}")] diff --git a/src/main.rs b/src/main.rs index 540a237..71fa846 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,12 +1,14 @@ use actix_cors::Cors; use actix_web::{App, HttpServer, web}; -use argon2::Argon2; +use argon2::{password_hash::rand_core::OsRng, Argon2}; use clap::Parser; use diesel_async::pooled_connection::AsyncDieselConnectionManager; use diesel_async::pooled_connection::deadpool::Pool; +use ed25519_dalek::{pkcs8::{spki::der::pem::LineEnding, DecodePrivateKey, EncodePrivateKey}, SigningKey}; use error::Error; use objects::MailClient; use simple_logger::SimpleLogger; +use tokio::{fs::{read_to_string, File}, io::AsyncWriteExt}; use std::time::SystemTime; mod config; use config::{Config, ConfigBuilder}; @@ -28,6 +30,8 @@ pub mod utils; struct Args { #[arg(short, long, default_value_t = String::from("/etc/gorb/config.toml"))] config: String, + #[arg(short, long, default_value_t = String::from("/etc/gorb/privkey.pem"))] + private_key: String, } #[derive(Clone)] @@ -42,6 +46,7 @@ pub struct Data { pub start_time: SystemTime, pub bunny_cdn: bunny_api_tokio::Client, pub mail_client: MailClient, + pub signing_key: SigningKey, } #[tokio::main] @@ -98,6 +103,18 @@ async fn main() -> Result<(), Error> { .await? .unwrap(); + let signing_key; + + if let Ok(content) = read_to_string(&args.private_key).await { + signing_key = SigningKey::from_pkcs8_pem(&content)?; + } else { + let mut csprng = OsRng; + signing_key = tokio::task::spawn_blocking(move || SigningKey::generate(&mut csprng)).await?; + + let mut file = File::create(args.private_key).await?; + file.write_all(signing_key.to_pkcs8_pem(LineEnding::LF)?.as_bytes()).await?; + } + /* **Stored for later possible use** @@ -124,6 +141,7 @@ async fn main() -> Result<(), Error> { start_time: SystemTime::now(), bunny_cdn, mail_client, + signing_key, }; HttpServer::new(move || { diff --git a/src/objects/channel.rs b/src/objects/channel.rs index 4d52353..9b756f2 100644 --- a/src/objects/channel.rs +++ b/src/objects/channel.rs @@ -198,46 +198,15 @@ impl Channel { let mut conn = data.pool.get().await?; use channels::dsl; - match update(channels::table) - .filter(dsl::is_above.eq(self.uuid)) - .set(dsl::is_above.eq(None::)) - .execute(&mut conn) - .await - { - Ok(r) => Ok(r), - Err(diesel::result::Error::NotFound) => Ok(0), - Err(e) => Err(e), - }?; - delete(channels::table) .filter(dsl::uuid.eq(self.uuid)) .execute(&mut conn) .await?; - match update(channels::table) - .filter(dsl::is_above.eq(self.uuid)) - .set(dsl::is_above.eq(self.is_above)) - .execute(&mut conn) - .await - { - Ok(r) => Ok(r), - Err(diesel::result::Error::NotFound) => Ok(0), - Err(e) => Err(e), - }?; - if data.get_cache_key(self.uuid.to_string()).await.is_ok() { data.del_cache_key(self.uuid.to_string()).await?; } - if data - .get_cache_key(format!("{}_channels", self.guild_uuid)) - .await - .is_ok() - { - data.del_cache_key(format!("{}_channels", self.guild_uuid)) - .await?; - } - Ok(()) } diff --git a/src/objects/guild.rs b/src/objects/guild.rs index 7d55595..f5e973d 100644 --- a/src/objects/guild.rs +++ b/src/objects/guild.rs @@ -26,6 +26,7 @@ pub struct GuildBuilder { name: String, description: Option, icon: Option, + owner_uuid: Uuid, } impl GuildBuilder { @@ -39,6 +40,7 @@ impl GuildBuilder { name: self.name, description: self.description, icon: self.icon.and_then(|i| i.parse().ok()), + owner_uuid: self.owner_uuid, roles, member_count, }) @@ -51,6 +53,7 @@ pub struct Guild { name: String, description: Option, icon: Option, + owner_uuid: Uuid, pub roles: Vec, member_count: i64, } @@ -107,6 +110,7 @@ impl Guild { name: name.clone(), description: None, icon: None, + owner_uuid, }; insert_into(guilds::table) @@ -121,7 +125,6 @@ impl Guild { nickname: None, user_uuid: owner_uuid, guild_uuid, - is_owner: true, }; insert_into(guild_members::table) @@ -134,6 +137,7 @@ impl Guild { name, description: None, icon: None, + owner_uuid, roles: vec![], member_count: 1, }) diff --git a/src/objects/member.rs b/src/objects/member.rs index 20bc848..f18e726 100644 --- a/src/objects/member.rs +++ b/src/objects/member.rs @@ -5,7 +5,7 @@ use diesel_async::RunQueryDsl; use serde::{Deserialize, Serialize}; use uuid::Uuid; -use crate::{error::Error, objects::{Permissions, Role}, schema::guild_members, Conn, Data}; +use crate::{Conn, Data, error::Error, schema::guild_members}; use super::{User, load_or_empty}; @@ -17,11 +17,10 @@ pub struct MemberBuilder { pub nickname: Option, pub user_uuid: Uuid, pub guild_uuid: Uuid, - pub is_owner: bool, } impl MemberBuilder { - pub async fn build(&self, data: &Data) -> Result { + async fn build(&self, data: &Data) -> Result { let user = User::fetch_one(data, self.user_uuid).await?; Ok(Member { @@ -29,22 +28,9 @@ impl MemberBuilder { nickname: self.nickname.clone(), user_uuid: self.user_uuid, guild_uuid: self.guild_uuid, - is_owner: self.is_owner, user, }) } - - pub async fn check_permission(&self, data: &Data, permission: Permissions) -> Result<(), Error> { - if !self.is_owner { - let roles = Role::fetch_from_member(&data, self.uuid).await?; - let allowed = roles.iter().any(|r| r.permissions & permission as i64 != 0); - if !allowed { - return Err(Error::Forbidden("Not allowed".to_string())) - } - } - - Ok(()) - } } #[derive(Serialize, Deserialize)] @@ -53,7 +39,6 @@ pub struct Member { pub nickname: Option, pub user_uuid: Uuid, pub guild_uuid: Uuid, - pub is_owner: bool, user: User, } @@ -73,16 +58,16 @@ impl Member { conn: &mut Conn, user_uuid: Uuid, guild_uuid: Uuid, - ) -> Result { + ) -> Result<(), Error> { use guild_members::dsl; - let member_builder = dsl::guild_members + dsl::guild_members .filter(dsl::user_uuid.eq(user_uuid)) .filter(dsl::guild_uuid.eq(guild_uuid)) .select(MemberBuilder::as_select()) .get_result(conn) .await?; - Ok(member_builder) + Ok(()) } pub async fn fetch_one(data: &Data, user_uuid: Uuid, guild_uuid: Uuid) -> Result { @@ -128,7 +113,6 @@ impl Member { guild_uuid, user_uuid, nickname: None, - is_owner: false, }; insert_into(guild_members::table) diff --git a/src/objects/mod.rs b/src/objects/mod.rs index 30a0a64..8731ed5 100644 --- a/src/objects/mod.rs +++ b/src/objects/mod.rs @@ -17,6 +17,7 @@ mod message; mod password_reset_token; mod role; mod user; +mod signature; pub use channel::Channel; pub use email_token::EmailToken; @@ -27,8 +28,8 @@ pub use member::Member; pub use message::Message; pub use password_reset_token::PasswordResetToken; pub use role::Role; -pub use role::Permissions; pub use user::User; +pub use signature::Signature; use crate::error::Error; @@ -112,6 +113,44 @@ impl MailClient { } } +#[derive(Clone, Copy)] +pub enum Permissions { + SendMessage = 1, + CreateChannel = 2, + DeleteChannel = 4, + ManageChannel = 8, + CreateRole = 16, + DeleteRole = 32, + ManageRole = 64, + CreateInvite = 128, + ManageInvite = 256, + ManageServer = 512, + ManageMember = 1024, +} + +impl Permissions { + pub fn fetch_permissions(permissions: i64) -> Vec { + let all_perms = vec![ + Self::SendMessage, + Self::CreateChannel, + Self::DeleteChannel, + Self::ManageChannel, + Self::CreateRole, + Self::DeleteRole, + Self::ManageRole, + Self::CreateInvite, + Self::ManageInvite, + Self::ManageServer, + Self::ManageMember, + ]; + + all_perms + .into_iter() + .filter(|p| permissions & (*p as i64) != 0) + .collect() + } +} + #[derive(Deserialize)] pub struct StartAmountQuery { pub start: Option, diff --git a/src/objects/role.rs b/src/objects/role.rs index a78798a..f67dc6d 100644 --- a/src/objects/role.rs +++ b/src/objects/role.rs @@ -3,14 +3,14 @@ use diesel::{ update, }; use diesel_async::RunQueryDsl; -use serde::{Deserialize, Serialize}; +use serde::Serialize; use uuid::Uuid; -use crate::{error::Error, schema::{role_members, roles}, utils::order_by_is_above, Conn, Data}; +use crate::{Conn, error::Error, schema::roles, utils::order_by_is_above}; use super::{HasIsAbove, HasUuid, load_or_empty}; -#[derive(Deserialize, Serialize, Clone, Queryable, Selectable, Insertable)] +#[derive(Serialize, Clone, Queryable, Selectable, Insertable)] #[diesel(table_name = roles)] #[diesel(check_for_backend(diesel::pg::Pg))] pub struct Role { @@ -19,28 +19,7 @@ pub struct Role { name: String, color: i32, is_above: Option, - pub permissions: i64, -} - -#[derive(Serialize, Clone, Queryable, Selectable, Insertable)] -#[diesel(table_name = role_members)] -#[diesel(check_for_backend(diesel::pg::Pg))] -pub struct RoleMember { - role_uuid: Uuid, - member_uuid: Uuid, -} - -impl RoleMember { - async fn fetch_role(&self, conn: &mut Conn) -> Result { - use roles::dsl; - let role: Role = dsl::roles - .filter(dsl::uuid.eq(self.role_uuid)) - .select(Role::as_select()) - .get_result(conn) - .await?; - - Ok(role) - } + permissions: i64, } impl HasUuid for Role { @@ -69,33 +48,6 @@ impl Role { Ok(roles) } - pub async fn fetch_from_member(data: &Data, member_uuid: Uuid) -> Result, Error> { - if let Ok(roles) = data.get_cache_key(format!("{}_roles", member_uuid)).await { - return Ok(serde_json::from_str(&roles)?) - } - - let mut conn = data.pool.get().await?; - - use role_members::dsl; - let role_memberships: Vec = load_or_empty( - dsl::role_members - .filter(dsl::member_uuid.eq(member_uuid)) - .select(RoleMember::as_select()) - .load(&mut conn) - .await, - )?; - - let mut roles = vec![]; - - for membership in role_memberships { - roles.push(membership.fetch_role(&mut conn).await?); - } - - data.set_cache_key(format!("{}_roles", member_uuid), roles.clone(), 300).await?; - - Ok(roles) - } - pub async fn fetch_one(conn: &mut Conn, role_uuid: Uuid) -> Result { use roles::dsl; let role: Role = dsl::roles @@ -107,10 +59,6 @@ impl Role { Ok(role) } - pub async fn fetch_permissions(&self) -> Vec { - Permissions::fetch_permissions(self.permissions.clone()) - } - pub async fn new(conn: &mut Conn, guild_uuid: Uuid, name: String) -> Result { let role_uuid = Uuid::now_v7(); @@ -146,41 +94,3 @@ impl Role { Ok(new_role) } } - -#[derive(Clone, Copy, PartialEq, Eq)] -pub enum Permissions { - SendMessage = 1, - CreateChannel = 2, - DeleteChannel = 4, - ManageChannel = 8, - CreateRole = 16, - DeleteRole = 32, - ManageRole = 64, - CreateInvite = 128, - ManageInvite = 256, - ManageServer = 512, - ManageMember = 1024, -} - -impl Permissions { - pub fn fetch_permissions(permissions: i64) -> Vec { - let all_perms = vec![ - Self::SendMessage, - Self::CreateChannel, - Self::DeleteChannel, - Self::ManageChannel, - Self::CreateRole, - Self::DeleteRole, - Self::ManageRole, - Self::CreateInvite, - Self::ManageInvite, - Self::ManageServer, - Self::ManageMember, - ]; - - all_perms - .into_iter() - .filter(|p| permissions & (*p as i64) != 0) - .collect() - } -} diff --git a/src/objects/signature.rs b/src/objects/signature.rs new file mode 100644 index 0000000..a333906 --- /dev/null +++ b/src/objects/signature.rs @@ -0,0 +1,68 @@ +use std::collections::HashMap; + +use actix_web::http::header::HeaderMap; +use url::Url; + +use crate::error::Error; + +pub struct Signature { + pub url: Url, + pub signature: String, +} + +impl Signature { + pub fn from_signature_header(headers: &HeaderMap) -> Result { + let signature_header = headers.get(actix_web::http::header::HeaderName::from_static("signature")); + + if signature_header.is_none() { + return Err(Error::Unauthorized( + "No signature header provided".to_string(), + )); + } + + let signature_raw = signature_header.unwrap().to_str()?; + + let key_values = signature_raw.split_whitespace(); + + let mut hash_map = HashMap::new(); + + let results: Result, Error> = key_values.map(|kv| { + let mut kv_split = kv.split('='); + let key = kv_split.next().unwrap().to_string(); + let value = kv_split.next().ok_or(Error::BadRequest(format!(r#"Expected key="value", found {}"#, key)))?.trim_matches('"').to_string(); + + hash_map.insert(key, value); + + Ok::<(), Error>(()) + }).collect(); + + results?; + + let key_id = hash_map.get("keyId"); + let algorithm = hash_map.get("algorithm"); + let signature = hash_map.get("signature"); + + if key_id.is_none() { + return Err(Error::BadRequest("No keyId was provided".to_string())) + } + + + if algorithm.is_none() { + return Err(Error::BadRequest("No key algorithm was provided".to_string())) + } + + if signature.is_none() { + return Err(Error::BadRequest("No signature was provided".to_string())) + } + + let key_id = key_id.unwrap(); + let algorithm = algorithm.unwrap(); + let signature = signature.unwrap(); + + if algorithm != "ed25519" { + return Err(Error::BadRequest(format!("Unsupported signature {}, please use ed25519", algorithm))) + } + + Ok(Signature { url: key_id.parse()?, signature: signature.clone() }) + } +} diff --git a/src/schema.rs b/src/schema.rs index c7a350c..7422f48 100644 --- a/src/schema.rs +++ b/src/schema.rs @@ -31,6 +31,15 @@ diesel::table! { } } +diesel::table! { + federated_users (uuid) { + uuid -> Uuid, + email_verified -> Bool, + #[max_length = 8000] + instance_url -> Varchar, + } +} + diesel::table! { guild_members (uuid) { uuid -> Uuid, @@ -38,13 +47,13 @@ diesel::table! { user_uuid -> Uuid, #[max_length = 100] nickname -> Nullable, - is_owner -> Bool, } } diesel::table! { guilds (uuid) { uuid -> Uuid, + owner_uuid -> Uuid, #[max_length = 100] name -> Varchar, #[max_length = 300] @@ -61,6 +70,15 @@ diesel::table! { } } +diesel::table! { + instances (instance_url) { + #[max_length = 8000] + instance_url -> Varchar, + #[max_length = 500] + public_key -> Varchar, + } +} + diesel::table! { invites (id) { #[max_length = 32] @@ -137,8 +155,10 @@ diesel::joinable!(access_tokens -> refresh_tokens (refresh_token)); diesel::joinable!(access_tokens -> users (uuid)); diesel::joinable!(channel_permissions -> channels (channel_uuid)); diesel::joinable!(channels -> guilds (guild_uuid)); +diesel::joinable!(federated_users -> instances (instance_url)); diesel::joinable!(guild_members -> guilds (guild_uuid)); diesel::joinable!(guild_members -> users (user_uuid)); +diesel::joinable!(guilds -> users (owner_uuid)); diesel::joinable!(instance_permissions -> users (uuid)); diesel::joinable!(invites -> guilds (guild_uuid)); diesel::joinable!(invites -> users (user_uuid)); @@ -152,9 +172,11 @@ diesel::allow_tables_to_appear_in_same_query!( access_tokens, channel_permissions, channels, + federated_users, guild_members, guilds, instance_permissions, + instances, invites, messages, refresh_tokens, diff --git a/src/utils.rs b/src/utils.rs index 3172cec..b3de7ad 100644 --- a/src/utils.rs +++ b/src/utils.rs @@ -1,4 +1,4 @@ -use std::sync::LazyLock; +use std::{collections::HashMap, sync::LazyLock}; use actix_web::{ cookie::{Cookie, SameSite, time::Duration},