Add OAuth support for the forums
the current login page is only meant to act as a placeholder until our designer is back online
This commit is contained in:
parent
fc66ba009c
commit
750b3d154c
7 changed files with 423 additions and 21 deletions
38
res/login.html
Normal file
38
res/login.html
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
<!-- straight stole this from some random template website, will replace with the splatnet one later - binder -->
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>Login - SPFN</title>
|
||||
<style>
|
||||
body { font-family: sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background-color: #f4f4f9; }
|
||||
.login-box { background: white; padding: 40px; border-radius: 8px; box-shadow: 0 4px 12px rgba(0,0,0,0.1); width: 300px; }
|
||||
h2 { margin-top: 0; color: #333; text-align: center; }
|
||||
.input-group { margin-bottom: 20px; }
|
||||
label { display: block; margin-bottom: 5px; color: #666; }
|
||||
input[type="text"], input[type="password"] { width: 100%; padding: 10px; border: 1px solid #ccc; border-radius: 4px; box-sizing: border-box; }
|
||||
button { width: 100%; padding: 10px; background-color: #007bff; border: none; color: white; border-radius: 4px; cursor: pointer; font-size: 16px; }
|
||||
button:hover { background-color: #0056b3; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="login-box">
|
||||
<h2>Sign In</h2>
|
||||
<form action="/api/v2/oauth2/authorize/submit" method="POST">
|
||||
<input type="hidden" name="client_id" value="{{client_id}}">
|
||||
<input type="hidden" name="redirect_uri" value="{{redirect_uri}}">
|
||||
<input type="hidden" name="state" value="{{state}}">
|
||||
|
||||
<div class="input-group">
|
||||
<label for="username">Username</label>
|
||||
<input type="text" id="username" name="username" required>
|
||||
</div>
|
||||
<div class="input-group">
|
||||
<label for="password">Password</label>
|
||||
<input type="password" id="password" name="password" required>
|
||||
</div>
|
||||
<button type="submit">Authorize Application</button>
|
||||
</form>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
90
src/json_api/oauth/authorize.rs
Normal file
90
src/json_api/oauth/authorize.rs
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
use rocket::FromForm;
|
||||
use rocket::{get, post, response::Redirect, http::{Status, ContentType}, State, form::Form};
|
||||
use std::fs;
|
||||
use rand::prelude::*;
|
||||
use sqlx::Row;
|
||||
use chrono::{Utc, Duration};
|
||||
use crate::json_api::oauth::generate_token::verify_nintendo_password;
|
||||
use crate::Pool;
|
||||
|
||||
#[derive(FromForm)]
|
||||
pub struct AuthorizeQueryParams<'r> {
|
||||
pub response_type: &'r str,
|
||||
pub client_id: &'r str,
|
||||
pub redirect_uri: &'r str,
|
||||
pub state: Option<&'r str>,
|
||||
}
|
||||
|
||||
#[derive(FromForm)]
|
||||
pub struct AuthorizeFormSubmit<'r> {
|
||||
pub username: &'r str,
|
||||
pub password: &'r str,
|
||||
pub client_id: &'r str,
|
||||
pub redirect_uri: &'r str,
|
||||
pub state: Option<&'r str>,
|
||||
}
|
||||
|
||||
#[get("/api/v2/oauth2/authorize?<params..>")]
|
||||
pub async fn authorize_page(params: AuthorizeQueryParams<'_>) -> Result<(ContentType, String), Status> {
|
||||
if params.response_type != "code" {
|
||||
return Err(Status::BadRequest);
|
||||
}
|
||||
|
||||
let html_content = fs::read_to_string("res/login.html")
|
||||
.map_err(|_| Status::InternalServerError)?;
|
||||
|
||||
let rendered = html_content
|
||||
.replace("{{client_id}}", params.client_id)
|
||||
.replace("{{redirect_uri}}", params.redirect_uri)
|
||||
.replace("{{state}}", params.state.unwrap_or(""));
|
||||
|
||||
Ok((ContentType::HTML, rendered))
|
||||
}
|
||||
|
||||
#[post("/api/v2/oauth2/authorize/submit", data = "<form_data>")]
|
||||
pub async fn authorize_submit(
|
||||
pool: &State<Pool>,
|
||||
form_data: Form<AuthorizeFormSubmit<'_>>
|
||||
) -> Result<Redirect, (Status, &'static str)> {
|
||||
|
||||
let user_row = match sqlx::query("SELECT pid, password FROM users WHERE username = $1")
|
||||
.bind(form_data.username)
|
||||
.fetch_optional(pool.inner())
|
||||
.await
|
||||
{
|
||||
Ok(Some(row)) => row,
|
||||
_ => return Err((Status::Unauthorized, "invalid_credentials")),
|
||||
};
|
||||
|
||||
let pid: i32 = user_row.get("pid");
|
||||
let db_bcrypt_hash: String = user_row.get("password");
|
||||
|
||||
let mut random_bytes = [0u8; 32];
|
||||
rand::rng().fill_bytes(&mut random_bytes);
|
||||
let secure_auth_code = hex::encode(random_bytes);
|
||||
let expires_at = Utc::now().naive_utc() + Duration::minutes(5);
|
||||
|
||||
if let Err(db_err) = sqlx::query(
|
||||
"INSERT INTO oauth_auth_codes (code, pid, redirect_uri, expires_at) VALUES ($1, $2, $3, $4)"
|
||||
)
|
||||
.bind(&secure_auth_code)
|
||||
.bind(pid)
|
||||
.bind(form_data.redirect_uri)
|
||||
.bind(expires_at)
|
||||
.execute(pool.inner())
|
||||
.await {
|
||||
eprintln!("failed to save auth code: {:?}", db_err);
|
||||
return Err((Status::InternalServerError, "server error saving session"));
|
||||
}
|
||||
|
||||
if !verify_nintendo_password(pid, form_data.password, &db_bcrypt_hash) {
|
||||
return Err((Status::Unauthorized, "invalid_credentials"));
|
||||
}
|
||||
|
||||
let mut target_redirect = format!("{}?code={}", form_data.redirect_uri, secure_auth_code);
|
||||
if let Some(state) = form_data.state {
|
||||
target_redirect.push_str(&format!("&state={}", state));
|
||||
}
|
||||
|
||||
Ok(Redirect::to(target_redirect))
|
||||
}
|
||||
|
|
@ -1,27 +1,166 @@
|
|||
use chrono::{Duration, NaiveDateTime, Utc};
|
||||
use rocket::{get, State};
|
||||
use rocket::serde::json::Json;
|
||||
use crate::Pool;
|
||||
use serde::Serialize;
|
||||
use crate::account::account::Auth;
|
||||
use rocket::FromForm;
|
||||
use sha2::{Sha256, Digest};
|
||||
use bytemuck::bytes_of;
|
||||
use rocket::{post, State, form::Form, http::Status, serde::json::Json, error};
|
||||
use sqlx::Row;
|
||||
use std::env;
|
||||
use once_cell::sync::Lazy;
|
||||
use crate::nnid::oauth::generate_token::create_token;
|
||||
use crate::nnid::oauth::generate_token::token_type::AUTH_TOKEN;
|
||||
use crate::Pool;
|
||||
use chrono::Utc;
|
||||
|
||||
pub static CLIENT_SECRET: Lazy<String> = Lazy::new(|| {
|
||||
env::var("OAUTH_CLIENT_SECRET").expect("OAUTH_CLIENT_SECRET not set")
|
||||
});
|
||||
|
||||
#[derive(Serialize)]
|
||||
pub struct TokenData{
|
||||
token: String,
|
||||
expiry: NaiveDateTime
|
||||
pub struct OAuthTokenResponse {
|
||||
pub access_token: String,
|
||||
pub token_type: String,
|
||||
pub expires_in: i64,
|
||||
}
|
||||
|
||||
#[get("/api/v2/oauth2/generate_token")]
|
||||
pub async fn generate_token(pool: &State<Pool>, auth: Auth<false>) -> Json<TokenData>{
|
||||
let pool = pool.inner();
|
||||
|
||||
Json(
|
||||
TokenData{
|
||||
expiry: Utc::now().naive_utc() + Duration::hours(1),
|
||||
token: create_token(pool, auth.pid, AUTH_TOKEN, None).await,
|
||||
|
||||
}
|
||||
)
|
||||
#[derive(FromForm)]
|
||||
pub struct TokenRequest<'r> {
|
||||
pub grant_type: &'r str,
|
||||
pub username: Option<&'r str>,
|
||||
pub password: Option<&'r str>,
|
||||
pub client_id: Option<&'r str>,
|
||||
pub client_secret: Option<&'r str>,
|
||||
pub code: Option<&'r str>,
|
||||
pub redirect_uri: Option<&'r str>,
|
||||
}
|
||||
|
||||
pub fn verify_nintendo_password(pid: i32, text_password: &str, db_bcrypt_hash: &str) -> bool {
|
||||
// maple: binder, there's already a function for this, why duplicate code?
|
||||
// binder: dear maple, with this function i can just hand it a pid, the password from the user and the db_bcrypt_hash and it gives me a true/false value.
|
||||
let mut sha = Sha256::new();
|
||||
sha.update(bytes_of(&pid));
|
||||
sha.update(&[0x02, 0x65, 0x43, 0x46]);
|
||||
sha.update(text_password.as_bytes());
|
||||
let hashed_password_hex = hex::encode(sha.finalize());
|
||||
match bcrypt::verify(hashed_password_hex, db_bcrypt_hash) {
|
||||
Ok(valid) => valid,
|
||||
Err(_) => false,
|
||||
}
|
||||
}
|
||||
|
||||
// dummy error responses
|
||||
#[derive(Serialize)]
|
||||
pub struct OAuthErrorResponse {
|
||||
pub error: String,
|
||||
}
|
||||
|
||||
#[post("/api/v2/oauth2/generate_token", data = "<form_data>")]
|
||||
pub async fn generate_token(
|
||||
pool: &State<Pool>,
|
||||
form_data: Form<TokenRequest<'_>>
|
||||
) -> Result<Json<OAuthTokenResponse>, (Status, Json<OAuthErrorResponse>)> {
|
||||
|
||||
if form_data.client_id != Some("account") {
|
||||
return Err((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_client".to_string() })
|
||||
));
|
||||
}
|
||||
|
||||
let cl_secret: String = CLIENT_SECRET.clone();
|
||||
if form_data.client_secret != Some(&cl_secret) {
|
||||
return Err((
|
||||
Status::Unauthorized,
|
||||
Json(OAuthErrorResponse { error: "invalid_client".to_string() })
|
||||
));
|
||||
}
|
||||
|
||||
// i'm only supporting the password grant incase someone feels lazy.
|
||||
let pid: i32 = match form_data.grant_type {
|
||||
"password" => {
|
||||
let username = form_data.username.ok_or((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_request".to_string() })
|
||||
))?;
|
||||
let password = form_data.password.ok_or((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_request".to_string() })
|
||||
))?;
|
||||
|
||||
let user_row = match sqlx::query("SELECT pid, password FROM users WHERE username = $1")
|
||||
.bind(username)
|
||||
.fetch_optional(pool.inner())
|
||||
.await
|
||||
{
|
||||
Ok(Some(row)) => row,
|
||||
_ => return Err((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
|
||||
)),
|
||||
};
|
||||
|
||||
let db_pid: i32 = user_row.get("pid");
|
||||
let db_bcrypt_hash: String = user_row.get("password");
|
||||
|
||||
if !verify_nintendo_password(db_pid, password, &db_bcrypt_hash) {
|
||||
return Err((
|
||||
Status::Unauthorized,
|
||||
Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
|
||||
));
|
||||
}
|
||||
|
||||
db_pid
|
||||
},
|
||||
|
||||
"authorization_code" => {
|
||||
let incoming_code = form_data.code.ok_or((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_request".to_string() })
|
||||
))?;
|
||||
|
||||
let code_row = match sqlx::query(
|
||||
"SELECT pid, expires_at, used FROM oauth_auth_codes WHERE code = $1"
|
||||
)
|
||||
.bind(incoming_code)
|
||||
.fetch_optional(pool.inner())
|
||||
.await
|
||||
{
|
||||
Ok(Some(row)) => row,
|
||||
_ => return Err((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
|
||||
)),
|
||||
};
|
||||
|
||||
let is_used: bool = code_row.get("used");
|
||||
let expires_at: chrono::NaiveDateTime = code_row.get("expires_at");
|
||||
let target_pid: i32 = code_row.get("pid");
|
||||
|
||||
if is_used || expires_at < Utc::now().naive_utc() {
|
||||
return Err((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
|
||||
));
|
||||
}
|
||||
|
||||
let _ = sqlx::query("UPDATE oauth_auth_codes SET used = TRUE WHERE code = $1")
|
||||
.bind(incoming_code)
|
||||
.execute(pool.inner())
|
||||
.await;
|
||||
|
||||
target_pid
|
||||
},
|
||||
|
||||
_ => return Err((
|
||||
Status::BadRequest,
|
||||
Json(OAuthErrorResponse { error: "unsupported_grant_type".to_string() })
|
||||
))
|
||||
};
|
||||
|
||||
let token = create_token(pool.inner(), pid, AUTH_TOKEN, None).await;
|
||||
|
||||
Ok(Json(OAuthTokenResponse {
|
||||
access_token: token,
|
||||
token_type: "Bearer".to_string(),
|
||||
expires_in: 3600,
|
||||
}))
|
||||
}
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
pub mod generate_token;
|
||||
|
||||
pub mod authorize;
|
||||
|
|
@ -1,10 +1,10 @@
|
|||
use rocket::serde::json::Json;
|
||||
use rocket::{get, State};
|
||||
use crate::account::account::Auth;
|
||||
use crate::nnid::people::{build_profile, GetOwnProfileData};
|
||||
use crate::nnid::people::{build_oauth_profile, GetOwnOAuthProfileData};
|
||||
use crate::Pool;
|
||||
|
||||
#[get("/api/v2/users/@me/profile")]
|
||||
pub async fn get_own_profile(_pool: &State<Pool>, auth: Auth<true>) -> Json<GetOwnProfileData> {
|
||||
Json(build_profile(auth.into()))
|
||||
pub async fn get_own_profile(_pool: &State<Pool>, auth: Auth<true>) -> Json<GetOwnOAuthProfileData> {
|
||||
Json(build_oauth_profile(auth.into()))
|
||||
}
|
||||
|
|
@ -116,6 +116,8 @@ async fn launch() -> _ {
|
|||
json_api::users::profile::get_own_profile,
|
||||
json_api::users::mii::get_mii_data_by_pid,
|
||||
json_api::users::delete::delete_account,
|
||||
json_api::oauth::authorize::authorize_page,
|
||||
json_api::oauth::authorize::authorize_submit,
|
||||
nnid::people::thing,
|
||||
// graphql::graphiql,
|
||||
// graphql::playground,
|
||||
|
|
|
|||
|
|
@ -180,6 +180,20 @@ struct EmailInfoOwnProfileData{
|
|||
validated_date: Option<NaiveDateTime>
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
struct EmailInfoOwnOAuthProfileData{
|
||||
address: String,
|
||||
id: u32,
|
||||
parent: bool,
|
||||
primary: bool,
|
||||
reachable: bool,
|
||||
#[serde(rename = "type")]
|
||||
email_type: String,
|
||||
updated_by: String,
|
||||
validated: bool,
|
||||
validated_date: Option<NaiveDateTime>
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
struct MiiImage{
|
||||
cached_url: String,
|
||||
|
|
@ -230,6 +244,31 @@ pub struct GetOwnProfileData{
|
|||
account_level: i32,
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
#[serde(rename(serialize = "person"))]
|
||||
pub struct GetOwnOAuthProfileData{
|
||||
active_flag: bool,
|
||||
birth_date: NaiveDate,
|
||||
country: String,
|
||||
create_date: NaiveDateTime,
|
||||
gender: String,
|
||||
language: String,
|
||||
updated: NaiveDateTime,
|
||||
marketing_flag: bool,
|
||||
off_device_flag: bool,
|
||||
pid: i32,
|
||||
id: i32,
|
||||
uid: i32,
|
||||
sub: i32,
|
||||
email: EmailInfoOwnOAuthProfileData,
|
||||
mii: MiiDataOwnProfileData,
|
||||
region: i32,
|
||||
tz_name: String,
|
||||
user_id: String,
|
||||
utc_offset: String,
|
||||
account_level: i32,
|
||||
}
|
||||
|
||||
#[get("/v1/api/people/@me/profile")]
|
||||
pub fn get_own_profile(user: Auth<false>) -> Ds<Xml<GetOwnProfileData>>{
|
||||
Ds(Xml(build_profile(user.into())))
|
||||
|
|
@ -330,6 +369,99 @@ pub fn build_profile(user: User) -> GetOwnProfileData {
|
|||
}
|
||||
}
|
||||
|
||||
pub fn build_oauth_profile(user: User) -> GetOwnOAuthProfileData {
|
||||
let User {
|
||||
username,
|
||||
pid,
|
||||
account_level,
|
||||
mii_data,
|
||||
gender,
|
||||
birthdate,
|
||||
country,
|
||||
creation_date,
|
||||
timezone,
|
||||
language,
|
||||
email,
|
||||
email_verified_since,
|
||||
updated,
|
||||
marketing_allowed,
|
||||
off_device_allowed,
|
||||
region,
|
||||
// verification_code,
|
||||
..
|
||||
} = user.into();
|
||||
|
||||
let timezone_offset = (&*OFFSET_FROM_TIMEZONE).get(&timezone).unwrap().to_owned();
|
||||
|
||||
// very bruteforce method, but i don't care.
|
||||
let id = pid;
|
||||
let sub = pid;
|
||||
let uid = pid;
|
||||
|
||||
let mii_data = mii_data
|
||||
.replace("\n", "")
|
||||
.replace("\t", "")
|
||||
.replace("\r", "")
|
||||
.replace(" ", "");
|
||||
|
||||
|
||||
GetOwnOAuthProfileData {
|
||||
id,
|
||||
sub,
|
||||
uid,
|
||||
active_flag: true,
|
||||
pid,
|
||||
user_id: username,
|
||||
gender,
|
||||
birth_date: birthdate,
|
||||
country,
|
||||
create_date: creation_date,
|
||||
tz_name: timezone,
|
||||
language,
|
||||
updated,
|
||||
marketing_flag: marketing_allowed,
|
||||
email: EmailInfoOwnOAuthProfileData {
|
||||
id: gxhash32(email.as_bytes(), 0),
|
||||
address: email,
|
||||
validated: email_verified_since.is_some(),
|
||||
validated_date: email_verified_since,
|
||||
email_type: "DEFAULT".to_string(),
|
||||
updated_by: "USER".to_string(),
|
||||
reachable: true,
|
||||
primary: true,
|
||||
parent: false,
|
||||
},
|
||||
mii: MiiDataOwnProfileData {
|
||||
id: gxhash32(mii_data.as_bytes(), 0),
|
||||
mii_hash: hex::encode(bytemuck::bytes_of(
|
||||
&(gxhash64(mii_data.as_bytes(), 1) & !(0x1000000000000000))
|
||||
)),
|
||||
name: crate::mii_util::MiiData::read(&mii_data)
|
||||
.map(|v| v.name)
|
||||
.unwrap_or_else(|| "INVALID".to_string()),
|
||||
primary: YesNoVal(true),
|
||||
data: mii_data,
|
||||
status: "COMPLETED".to_string(),
|
||||
mii_images: MiiImages {
|
||||
mii_image: {
|
||||
let image_url = get_mii_img_url(pid, "png");
|
||||
let url_hash = gxhash32(image_url.as_bytes(), 0);
|
||||
MiiImage {
|
||||
image_type: "standard".to_string(),
|
||||
id: url_hash,
|
||||
url: image_url.clone(),
|
||||
cached_url: image_url,
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
off_device_flag: off_device_allowed,
|
||||
region,
|
||||
utc_offset: timezone_offset,
|
||||
account_level,
|
||||
}
|
||||
}
|
||||
|
||||
#[put("/v1/api/people/@me/miis/@primary", data = "<data>")]
|
||||
pub async fn change_mii(
|
||||
database: &State<Pool>,
|
||||
|
|
@ -360,6 +492,7 @@ pub async fn change_mii(
|
|||
Ok(())
|
||||
}
|
||||
|
||||
|
||||
#[post("/v1/api/people/@me/agreements")]
|
||||
pub async fn thing(){
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue