|
Enter the following 6-digit code on your console:
diff --git a/res/email/masterKeyTemplate.html b/res/email/masterKeyTemplate.html
deleted file mode 100644
index 50f3f9c..0000000
--- a/res/email/masterKeyTemplate.html
+++ /dev/null
@@ -1,190 +0,0 @@
-
-
-
-
-
-
-
-
- Hello. You have requested a reset of parental controls on your console.
-
-
-
-
-
-
-
-
- | |
-
-
-
- | |
-
-
-
-
-
-
-
- 
-
- |
-
-
- | |
-
-
-
-
-
- | |
-
-
-
- | |
-
-
- |
- Hello.
- |
-
-
- | |
-
-
- |
- Your email was linked to a Wii U console with serial number {{serial}} for parental controls.
- |
-
-
- | |
-
-
- |
- You have requested a master key to reset your parental controls PIN. The master key you must enter on your Wii U is:
- |
-
-
- | |
-
-
- |
- {{mkey}}
- |
-
-
- | |
-
-
- |
- Please make sure to change your PIN as soon as possible.
- |
-
-
- |
- The SPFN team
- |
-
-
- | |
-
-
- |
- |
-
-
- |
-
-
- | |
-
-
- |
- Note: this email message was auto-generated, please do not respond. For further assistance, please join our Discord server.
- |
-
-
- | |
-
-
- |
-
-
- |
- |
-
-
- |
-
-
- |
-
-
-
-
\ No newline at end of file
diff --git a/res/email/parentalControlsTemplate.html b/res/email/parentalControlsTemplate.html
deleted file mode 100644
index 92c1cdb..0000000
--- a/res/email/parentalControlsTemplate.html
+++ /dev/null
@@ -1,177 +0,0 @@
-
-
-
-
-
-
-
-
- Hello. The console with the serial number {{serial}} has been linked to your email for parental controls.
-
-
-
-
-
-
-
-
- | |
-
-
-
- | |
-
-
-
-
-
- |
-
-
-
- |
-
-
- | |
-
-
-
-
-
- | |
-
-
-
- | |
-
-
- |
- Hello.
- |
-
-
- | |
-
-
- |
- Your email was linked to a Wii U console with serial number {{serial}} for parental controls.
- |
-
-
- | |
-
-
- |
- If you did not authorize this, please contact our team at support@spbr.net.
- |
-
-
- | |
-
-
- |
- The SPFN team
- |
-
-
- | |
-
-
- |
- |
-
-
- |
-
-
- | |
-
-
- |
- Note: this email message was auto-generated, please do not respond. For further assistance, please join our Discord server.
- |
-
-
- | |
-
-
- |
-
-
- |
- |
-
-
- |
-
-
- |
-
-
-
-
\ No newline at end of file
diff --git a/res/email/resetTemplate.html b/res/email/resetTemplate.html
deleted file mode 100644
index 84b899a..0000000
--- a/res/email/resetTemplate.html
+++ /dev/null
@@ -1,190 +0,0 @@
-
-
-
-
-
-
-
-
- Hello {{username}}. Your Splatfestival Network ID password reset has been processed. You may use the temporary password below to log into your account.
-
-
-
-
-
-
-
-
- | |
-
-
-
- | |
-
-
-
-
-
- |
-
-
-
- |
-
-
- | |
-
-
-
-
-
- | |
-
-
-
- | |
-
-
- |
- Hello {{username}}.
- |
-
-
- | |
-
-
- |
- Your Splatfestival Network ID password reset has been processed.
- |
-
-
- |
- You may use the following temporary password to login:
- |
-
-
- | |
-
-
- |
- {{password}}
- |
-
-
- | |
-
-
- |
- Please change your password as soon as you can on your Wii U. (Click your mii on the top-left of the Wii U Menu and scroll to "Change Password")
- |
-
-
- | |
-
-
- |
- The SPFN team
- |
-
-
- | |
-
-
- |
- |
-
-
- |
-
-
- | |
-
-
- |
- Note: this email message was auto-generated, please do not respond. For further assistance, please join our Discord server.
- |
-
-
- | |
-
-
- |
-
-
- |
- |
-
-
- |
-
-
- |
-
-
-
-
\ No newline at end of file
diff --git a/src/account/account.rs b/src/account/account.rs
index 5dd5fe0..fd58a1b 100644
--- a/src/account/account.rs
+++ b/src/account/account.rs
@@ -64,7 +64,6 @@ pub struct User {
pub updated: NaiveDateTime,
pub nex_password: String,
pub verification_code: Option,
- pub eula_version: i32,
}
#[derive(sqlx::FromRow)]
@@ -118,10 +117,7 @@ pub fn generate_password(pid: i32, cleartext_password: &str) -> Option {
bcrypt::hash(password, 10).ok()
}
-pub async fn read_basic_auth_token(
- connection: &Pool,
- token: &str,
-) -> Option<(User, Option<[u8; 32]>)> {
+pub async fn read_basic_auth_token(connection: &Pool, token: &str) -> Option {
let data = match BASE64_STANDARD.decode(&token) {
Ok(d) => d,
Err(e) => {
@@ -165,69 +161,13 @@ pub async fn read_basic_auth_token(
let password_valid = user.verify_cleartext_password(&login_password);
if password_valid == Some(true) {
- Some((user, None))
+ Some(user)
} else {
None
}
}
-pub async fn read_hashed_basic_auth_token(
- connection: &Pool,
- token: &str,
-) -> Option<(User, Option<[u8; 32]>)> {
- let data = match BASE64_STANDARD.decode(token) {
- Ok(d) => d,
- Err(e) => {
- println!("Failed to decode base64: {:?}", e);
- return None;
- }
- };
-
- let decoded_token = match String::from_utf8(data) {
- Ok(s) => s,
- Err(e) => {
- println!("Failed to convert decoded bytes to UTF-8 string: {:?}", e);
- return None;
- }
- };
-
- let (login_username, login_hash) = match decoded_token.split_once(' ') {
- Some(parts) => parts,
- None => {
- println!("Failed to split hashed basic token into username and hash");
- return None;
- }
- };
-
- let user_result = sqlx::query_as!(
- User,
- "SELECT * FROM users WHERE username = $1",
- login_username
- )
- .fetch_one(connection)
- .await;
-
- let user = match user_result {
- Ok(u) => u,
- Err(e) => {
- println!("Failed to fetch user from database: {:?}", e);
- return None;
- }
- };
-
- let password_valid = user.verify_hashed_password(login_hash);
-
- if password_valid == Some(true) {
- Some((user, None))
- } else {
- None
- }
-}
-
-pub async fn read_bearer_auth_token(
- connection: &Pool,
- token: &str,
-) -> Option<(User, Option<[u8; 32]>)> {
+pub async fn read_bearer_auth_token(connection: &Pool, token: &str) -> Option {
let data = TokenData::decode(token)?;
let token_info = sqlx::query!(
@@ -249,11 +189,11 @@ pub async fn read_bearer_auth_token(
.await
.ok()?;
- Some((user, token_info.cert_hash.and_then(|v| v.try_into().ok())))
+ Some(user)
}
pub fn generate_nex_password() -> String {
- let mut rng = rand::rng();
+ let mut rng = rand::rng();
let mut output = String::with_capacity(16);
while output.len() < 16 {
@@ -274,7 +214,6 @@ pub fn generate_nex_password() -> String {
pub struct Auth(
pub User,
- pub Option<[u8; 32]>,
);
impl AsRef
@@ -339,7 +278,6 @@ pub async fn link_certificate_to_pid(
Ok(())
}
-// todo: make this more consistent by requiring a cert to be asociated to the token if USE_CERT is set
#[async_trait]
impl<'r, const FORCE_BEARER_AUTH: bool, const USE_CERT: bool> FromRequest<'r>
for Auth
@@ -359,14 +297,13 @@ impl<'r, const FORCE_BEARER_AUTH: bool, const USE_CERT: bool> FromRequest<'r>
let (auth_type, token) = request_try!(auth.split_once(' ').ok_or(INVALID_TOKEN_ERRORS));
- let data = match auth_type {
+ let user = match auth_type {
"Basic" if !FORCE_BEARER_AUTH => read_basic_auth_token(pool, token).await,
- "HashedBasic" if !FORCE_BEARER_AUTH => read_hashed_basic_auth_token(pool, token).await,
"Bearer" => read_bearer_auth_token(pool, token).await,
_ => return Outcome::Error((Status::BadRequest, INVALID_TOKEN_ERRORS)),
};
- let Some((user, cert)) = data else {
+ let Some(user) = user else {
return Outcome::Error((Status::BadRequest, INVALID_TOKEN_ERRORS));
};
@@ -379,7 +316,7 @@ impl<'r, const FORCE_BEARER_AUTH: bool, const USE_CERT: bool> FromRequest<'r>
// ..user
// };
- Outcome::Success(Self(user, cert))
+ Outcome::Success(Self(user))
}
}
diff --git a/src/email.rs b/src/email.rs
index b0ebd9f..255fe49 100644
--- a/src/email.rs
+++ b/src/email.rs
@@ -36,104 +36,3 @@ pub async fn send_verification_email(to: &str, code: i32, username: &str) -> Res
Ok(())
}
-
-pub async fn send_reset_email(to: &str, pwd: &str, username: &str) -> Result<(), String> {
- let smtp_user = env::var("SMTP_USER").map_err(|_| "SMTP_USER not set".to_string())?;
- let smtp_pass = env::var("SMTP_PASS").map_err(|_| "SMTP_PASS not set".to_string())?;
- let smtp_server = env::var("SMTP_SERVER").map_err(|_| "SMTP_SERVER not set".to_string())?;
-
- // Load template
- let template = fs::read_to_string("res/email/resetTemplate.html")
- .map_err(|e| format!("Failed to read email template: {}", e))?;
-
- // Replace placeholders
- let body = template
- .replace("{{username}}", username)
- .replace("{{password}}", pwd);
-
- let email = Message::builder()
- .from(smtp_user.parse().unwrap())
- .to(to.parse().unwrap())
- .subject("Password Reset for SPFN")
- .header(lettre::message::header::ContentType::TEXT_HTML)
- .body(body)
- .map_err(|e| e.to_string())?;
-
- let creds = Credentials::new(smtp_user, smtp_pass);
-
- let mailer = SmtpTransport::relay(&smtp_server)
- .map_err(|e| e.to_string())?
- .credentials(creds)
- .build();
-
- mailer.send(&email).map_err(|e| e.to_string())?;
-
- Ok(())
-}
-
-pub async fn send_pc_email(to: &str, serial: &str) -> Result<(), String> {
- let smtp_user = env::var("SMTP_USER").map_err(|_| "SMTP_USER not set".to_string())?;
- let smtp_pass = env::var("SMTP_PASS").map_err(|_| "SMTP_PASS not set".to_string())?;
- let smtp_server = env::var("SMTP_SERVER").map_err(|_| "SMTP_SERVER not set".to_string())?;
-
- // Load template
- let template = fs::read_to_string("res/email/parentalControlsTemplate.html")
- .map_err(|e| format!("Failed to read email template: {}", e))?;
-
- // Replace placeholders
- let body = template
- .replace("{{serial}}", serial);
-
- let email = Message::builder()
- .from(smtp_user.parse().unwrap())
- .to(to.parse().unwrap())
- .subject("Parental controls confirmation for SPFN")
- .header(lettre::message::header::ContentType::TEXT_HTML)
- .body(body)
- .map_err(|e| e.to_string())?;
-
- let creds = Credentials::new(smtp_user, smtp_pass);
-
- let mailer = SmtpTransport::relay(&smtp_server)
- .map_err(|e| e.to_string())?
- .credentials(creds)
- .build();
-
- mailer.send(&email).map_err(|e| e.to_string())?;
-
- Ok(())
-}
-
-pub async fn send_reset_pin_email(to: &str, serial: &str, master_key: &str) -> Result<(), String> {
- let smtp_user = env::var("SMTP_USER").map_err(|_| "SMTP_USER not set".to_string())?;
- let smtp_pass = env::var("SMTP_PASS").map_err(|_| "SMTP_PASS not set".to_string())?;
- let smtp_server = env::var("SMTP_SERVER").map_err(|_| "SMTP_SERVER not set".to_string())?;
-
- // Load template
- let template = fs::read_to_string("res/email/masterKeyTemplate.html")
- .map_err(|e| format!("Failed to read email template: {}", e))?;
-
- // Replace placeholders
- let body = template
- .replace("{{serial}}", serial)
- .replace("{{mkey}}", master_key);
-
- let email = Message::builder()
- .from(smtp_user.parse().unwrap())
- .to(to.parse().unwrap())
- .subject("Parental controls PIN reset for SPFN")
- .header(lettre::message::header::ContentType::TEXT_HTML)
- .body(body)
- .map_err(|e| e.to_string())?;
-
- let creds = Credentials::new(smtp_user, smtp_pass);
-
- let mailer = SmtpTransport::relay(&smtp_server)
- .map_err(|e| e.to_string())?
- .credentials(creds)
- .build();
-
- mailer.send(&email).map_err(|e| e.to_string())?;
-
- Ok(())
-}
\ No newline at end of file
diff --git a/src/json_api/admin/bans.rs b/src/json_api/admin/bans.rs
index fa211c6..94ebef5 100644
--- a/src/json_api/admin/bans.rs
+++ b/src/json_api/admin/bans.rs
@@ -1,7 +1,11 @@
+use rocket::serde::json::Json;
use rocket::{post, FromForm, State};
use rocket::form::Form;
+use rocket::futures::TryFutureExt;
use rocket::http::Status;
use crate::account::account::Auth;
+use crate::json_api::oauth::generate_token::TokenRequest;
+use crate::nnid::people::{build_oauth_profile, GetOwnOAuthProfileData};
use crate::Pool;
#[derive(FromForm)]
@@ -17,7 +21,7 @@ pub async fn ban_user(pool: &State, auth: Auth, request: Form = Lazy::new(|| {
+ env::var("OAUTH_CLIENT_SECRET").expect("OAUTH_CLIENT_SECRET not set")
+});
#[derive(Serialize)]
pub struct OAuthTokenResponse {
@@ -28,14 +34,17 @@ pub struct TokenRequest<'r> {
}
pub fn verify_nintendo_password(pid: i32, text_password: &str, db_bcrypt_hash: &str) -> bool {
+ // maple: binder, there's already a function for this, why duplicate code?
+ // binder: dear maple, with this function i can just hand it a pid, the password from the user and the db_bcrypt_hash and it gives me a true/false value.
let mut sha = Sha256::new();
sha.update(bytes_of(&pid));
sha.update(&[0x02, 0x65, 0x43, 0x46]);
sha.update(text_password.as_bytes());
let hashed_password_hex = hex::encode(sha.finalize());
- bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or(false)
+ bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or_else(|_| false)
}
+// dummy error responses
#[derive(Serialize)]
pub struct OAuthErrorResponse {
pub error: String,
@@ -43,92 +52,53 @@ pub struct OAuthErrorResponse {
#[post("/api/v2/oauth2/generate_token", data = "")]
pub async fn generate_token(
- pool: &State,
- form_data: Form>,
+ pool: &State,
+ form_data: Form>
) -> Result, (Status, Json)> {
- println!("redirect URI is: {:?}", form_data.redirect_uri);
-
- let client_id = form_data.client_id.ok_or((
- Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_client".to_string(),
- }),
- ))?;
-
- let client_row = match sqlx::query(
- "SELECT client_secret, is_confidential FROM oauth_clients WHERE client_id = $1",
- )
- .bind(client_id)
- .fetch_optional(pool.inner())
- .await
- {
- Ok(Some(row)) => row,
+
+ match form_data.client_id {
+ Some("account") | Some("splatnet") => {
+ let cl_secret: String = CLIENT_SECRET.clone();
+ if form_data.client_secret != Some(&cl_secret) {
+ return Err((
+ Status::Unauthorized,
+ Json(OAuthErrorResponse { error: "invalid_client".to_string() })
+ ));
+ }
+ }
+ Some("website") => {
+ // no secret for this client, cant be kept confidential in the case of the website
+ }
_ => {
return Err((
- Status::Unauthorized,
- Json(OAuthErrorResponse {
- error: "invalid_client".to_string(),
- }),
- ));
- }
- };
-
- let db_client_secret: Option = client_row.get("client_secret");
- let is_confidential: bool = client_row.get("is_confidential");
-
- if is_confidential {
- let provided_secret = form_data.client_secret.ok_or((
- Status::Unauthorized,
- Json(OAuthErrorResponse {
- error: "invalid_client".to_string(),
- }),
- ))?;
-
- let matches = match db_client_secret {
- Some(secret) => secret == provided_secret,
- None => false,
- };
-
- if !matches {
- return Err((
- Status::Unauthorized,
- Json(OAuthErrorResponse {
- error: "invalid_client".to_string(),
- }),
+ Status::BadRequest,
+ Json(OAuthErrorResponse { error: "invalid_client".to_string() })
));
}
}
- // i'm only supporting the password grant for the id server.
+ // i'm only supporting the password grant incase someone feels lazy.
let pid: i32 = match form_data.grant_type {
"password" => {
let username = form_data.username.ok_or((
Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_request".to_string(),
- }),
+ Json(OAuthErrorResponse { error: "invalid_request".to_string() })
))?;
let password = form_data.password.ok_or((
Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_request".to_string(),
- }),
+ Json(OAuthErrorResponse { error: "invalid_request".to_string() })
))?;
let user_row = match sqlx::query("SELECT pid, password FROM users WHERE username = $1")
.bind(username)
.fetch_optional(pool.inner())
- .await
+ .await
{
Ok(Some(row)) => row,
- _ => {
- return Err((
- Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_grant".to_string(),
- }),
- ));
- }
+ _ => return Err((
+ Status::BadRequest,
+ Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
+ )),
};
let db_pid: i32 = user_row.get("pid");
@@ -137,39 +107,31 @@ pub async fn generate_token(
if !verify_nintendo_password(db_pid, password, &db_bcrypt_hash) {
return Err((
Status::Unauthorized,
- Json(OAuthErrorResponse {
- error: "invalid_grant".to_string(),
- }),
+ Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
));
}
db_pid
- }
+ },
"authorization_code" => {
let incoming_code = form_data.code.ok_or((
- Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_request".to_string(),
- }),
+ Status::BadRequest,
+ Json(OAuthErrorResponse { error: "invalid_request".to_string() })
))?;
-
+
let code_row = match sqlx::query(
- "SELECT pid, expires_at, used FROM oauth_auth_codes WHERE code = $1",
+ "SELECT pid, expires_at, used FROM oauth_auth_codes WHERE code = $1"
)
.bind(incoming_code)
.fetch_optional(pool.inner())
.await
{
Ok(Some(row)) => row,
- _ => {
- return Err((
- Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_grant".to_string(),
- }),
- ));
- }
+ _ => return Err((
+ Status::BadRequest,
+ Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
+ )),
};
let is_used: bool = code_row.get("used");
@@ -178,10 +140,8 @@ pub async fn generate_token(
if is_used || expires_at < Utc::now().naive_utc() {
return Err((
- Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "invalid_grant".to_string(),
- }),
+ Status::BadRequest,
+ Json(OAuthErrorResponse { error: "invalid_grant".to_string() })
));
}
@@ -191,23 +151,19 @@ pub async fn generate_token(
.await;
target_pid
- }
+ },
- _ => {
- return Err((
- Status::BadRequest,
- Json(OAuthErrorResponse {
- error: "unsupported_grant_type".to_string(),
- }),
- ));
- }
+ _ => return Err((
+ Status::BadRequest,
+ Json(OAuthErrorResponse { error: "unsupported_grant_type".to_string() })
+ ))
};
- let token = create_token(pool.inner(), pid, AUTH_TOKEN, None, None).await;
+ let token = create_token(pool.inner(), pid, AUTH_TOKEN, None).await;
Ok(Json(OAuthTokenResponse {
access_token: token,
token_type: "Bearer".to_string(),
expires_in: 3600,
}))
-}
\ No newline at end of file
+}
diff --git a/src/json_api/users/console.rs b/src/json_api/users/console.rs
deleted file mode 100644
index 7ab32c3..0000000
--- a/src/json_api/users/console.rs
+++ /dev/null
@@ -1,40 +0,0 @@
-use rocket::serde::json::Json;
-use rocket::{get, State};
-use rocket::http::Status;
-use crate::account::account::Auth;
-use serde::Serialize;
-use crate::Pool;
-
-#[derive(Serialize)]
-pub struct ConsoleData {
- pub serial: String,
- pub cert_hash: String,
-}
-
-#[get("/api/v2/users/@me/console")]
-pub async fn get_own_console(pool: &State, auth: Auth) -> Result, (Status, &'static str)> {
- let hash = auth.1.ok_or((Status::BadRequest, "token needs cert hash"))?;
-
- let row = sqlx::query!(
- "select serial from certificates where hash = $1",
- &hash[..]
- )
- .fetch_one(pool.inner())
- .await
- .map_err(|e| {
- log::error!("failed to execute query: {:?}", e);
- (Status::InternalServerError, "error in database query")
- })?;
-
- let hex_hash = hex::encode(hash);
- let serial = row.serial.ok_or((Status::BadRequest, "we had no serial"))?;
-
- Ok(
- Json (
- ConsoleData {
- serial,
- cert_hash: hex_hash
- }
- )
- )
-}
\ No newline at end of file
diff --git a/src/json_api/users/mod.rs b/src/json_api/users/mod.rs
index a71fca3..b284f7e 100644
--- a/src/json_api/users/mod.rs
+++ b/src/json_api/users/mod.rs
@@ -1,4 +1,3 @@
pub mod profile;
pub mod mii;
-pub mod delete;
-pub mod console;
\ No newline at end of file
+pub mod delete;
\ No newline at end of file
diff --git a/src/main.rs b/src/main.rs
index 622d3ed..35a48df 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -101,21 +101,11 @@ async fn launch() -> _ {
nnid::support::validate,
nnid::support::verify_email,
nnid::support::resend_email,
- nnid::support::forgotten_password,
- nnid::support::send_parental_controls_pin,
- nnid::support::send_forgotten_pin,
nnid::people::create_account,
nnid::people::get_own_profile,
nnid::people::get_device_owner,
nnid::people::get_own_device,
nnid::people::change_mii,
- nnid::people::update_account,
- nnid::people::delete_account,
- nnid::people::get_user_devices,
- nnid::people::get_device_status,
- nnid::people::inactivate_current_device,
- nnid::people::get_own_emails,
- nnid::people::update_primary_email,
nnid::miis::get_miis,
nnid::oauth::generate_token::generate_token,
nnid::provider::get_nex_token,
@@ -129,7 +119,6 @@ async fn launch() -> _ {
json_api::oauth::authorize::authorize_page,
json_api::oauth::authorize::authorize_submit,
json_api::admin::bans::ban_user,
- json_api::users::console::get_own_console,
nnid::people::thing,
// graphql::graphiql,
// graphql::playground,
diff --git a/src/nnid/agreements.rs b/src/nnid/agreements.rs
index 4fa2d59..cc97c70 100644
--- a/src/nnid/agreements.rs
+++ b/src/nnid/agreements.rs
@@ -1,64 +1,37 @@
-use std::{env, io, fs};
-use serde::Deserialize;
+use std::{env, io};
+use std::collections::HashSet;
use once_cell::sync::Lazy;
use rocket::fs::NamedFile;
-use rocket::get;
+use rocket::{get, Request};
+use rocket::http::Status;
+use rocket::request::{FromRequest, Outcome};
use rocket::response::content::RawXml;
use tokio::fs::try_exists;
+use tokio::sync::RwLock;
+use rocket::async_trait;
use crate::dsresponse::Ds;
-// pub static EVIL_AGREEMENT_THING: Lazy>> = Lazy::new(|| Default::default());
+pub static EVIL_AGREEMENT_THING: Lazy>> = Lazy::new(|| Default::default());
-// pub struct CFIP(pub String);
+pub struct CFIP(pub String);
-// #[async_trait]
-// impl<'r> FromRequest<'r> for CFIP{
-// type Error = ();
+#[async_trait]
+impl<'r> FromRequest<'r> for CFIP{
+ type Error = ();
-// async fn from_request(request: &'r Request<'_>) -> Outcome {
-// match request.headers().get("CF-Connecting-IP").next(){
-// Some(v) => Outcome::Success(Self(v.to_owned())),
-// None => Outcome::Error((Status::ImATeapot, ()))
-// }
-// }
-// }
-
-#[derive(Debug, Deserialize)]
-struct Agreement {
- version: String,
+ async fn from_request(request: &'r Request<'_>) -> Outcome {
+ match request.headers().get("CF-Connecting-IP").next(){
+ Some(v) => Outcome::Success(Self(v.to_owned())),
+ None => Outcome::Error((Status::ImATeapot, ()))
+ }
+ }
}
-#[derive(Debug, Deserialize)]
-struct Agreements {
- #[serde(rename = "agreement")]
- agreements: Vec,
-}
-
-pub fn get_latest_eula_version() -> Result> {
- let mut path = std::env::current_dir()?;
- path.push("res");
- path.push("agreement");
- path.push("DEFAULT.xml");
-
- let content = fs::read_to_string(path)?;
- let parsed: Agreements = quick_xml::de::from_str(&content)?;
-
- parsed
- .agreements
- .first()
- .map(|a| a.version.clone())
- .ok_or_else(|| "No agreement found in XML".into())
-}
-
-pub static LATEST_EULA_VERSION: Lazy = Lazy::new(|| {
- get_latest_eula_version()
- .ok()
- .and_then(|v| v.parse::().ok())
- .unwrap_or(300)
-});
#[get("/v1/api/content/agreements/Nintendo-Network-EULA//@latest")]
-pub async fn get_agreement(lang: &str) -> io::Result>>{
+pub async fn get_agreement(lang: &str, ip: CFIP) -> io::Result>>{
+
+
let base_path = {
// if this crashes then something is wrong with the server setup so crashing here is fine imo
let mut path = env::current_dir().unwrap();
@@ -69,26 +42,38 @@ pub async fn get_agreement(lang: &str) -> io::Result>>{
path
};
- let requested_file_path = {
- let mut path = base_path.clone();
-
- path.push(format!("{}.xml", lang));
-
- path
- };
-
-
- if try_exists(&requested_file_path).await.is_ok_and(|v| v == true) {
- Ok(Ds(RawXml(NamedFile::open(&requested_file_path).await?)))
- } else {
- let fallback_path = {
+ if EVIL_AGREEMENT_THING.read().await.contains(&ip.0) {
+ let path = {
let mut path = base_path;
- path.push("DEFAULT.xml");
+ path.push("EVIL.xml");
path
};
- Ok(Ds(RawXml(NamedFile::open(&fallback_path).await?)))
+ Ok(Ds(RawXml(NamedFile::open(&path).await?)))
+ } else {
+ let requested_file_path = {
+ let mut path = base_path.clone();
+
+ path.push(format!("{}.xml", lang));
+
+ path
+ };
+
+
+ if try_exists(&requested_file_path).await.is_ok_and(|v| v == true) {
+ Ok(Ds(RawXml(NamedFile::open(&requested_file_path).await?)))
+ } else {
+ let fallback_path = {
+ let mut path = base_path;
+
+ path.push("DEFAULT.xml");
+
+ path
+ };
+
+ Ok(Ds(RawXml(NamedFile::open(&fallback_path).await?)))
+ }
}
}
\ No newline at end of file
diff --git a/src/nnid/oauth/generate_token.rs b/src/nnid/oauth/generate_token.rs
index d556928..a239ab3 100644
--- a/src/nnid/oauth/generate_token.rs
+++ b/src/nnid/oauth/generate_token.rs
@@ -1,50 +1,50 @@
#![allow(unused)]
-use crate::Pool;
+use rocket::{post, FromForm, State};
+use rocket::form::Form;
+use serde::{Serialize};
use crate::account::account::{Auth, DeviceCert, User, link_certificate_to_pid};
use crate::error::{Error, Errors};
-use crate::nnid::oauth::TokenData;
+use crate::nnid::agreements::{CFIP, EVIL_AGREEMENT_THING};
use crate::nnid::oauth::generate_token::token_type::{AUTH_REFRESH_TOKEN, AUTH_TOKEN};
-use crate::nnid::agreements::LATEST_EULA_VERSION;
+use crate::nnid::oauth::TokenData;
+use crate::Pool;
use crate::xml::Xml;
-use rocket::form::Form;
-use rocket::{FromForm, State, post};
-use serde::Serialize;
-pub mod token_type {
+pub mod token_type{
pub const AUTH_REFRESH_TOKEN: i32 = 1;
pub const AUTH_TOKEN: i32 = 0;
pub const NEX_TOKEN: i32 = 2;
}
-const ACCOUNT_ID_OR_PASSWORD_ERRORS: Errors = Errors {
- error: &[Error {
- code: "0106",
- message: "Invalid account ID or password",
- }],
+const ACCOUNT_ID_OR_PASSWORD_ERRORS: Errors = Errors{
+ error: &[
+ Error{
+ code: "0106",
+ message: "Invalid account ID or password"
+ }
+ ]
};
-const ACCOUNT_BANNED_ERRORS: Errors = Errors {
- error: &[Error {
- code: "0108",
- message: "Account banned from server",
- }],
+const ACCOUNT_BANNED_ERRORS: Errors = Errors{
+ error: &[
+ Error{
+ code: "0108",
+ message: "Account banned from server"
+ }
+ ]
};
-const ACCOUNT_TEMPBANNED_ERRORS: Errors = Errors {
- error: &[Error {
- code: "0132",
- message: "Account temporarily banned from server",
- }],
-};
-const REREAD_EULA_ERRORS: Errors = Errors {
- error: &[Error {
- code: "0109",
- message: "The EULA has been updated",
- }],
+const REREAD_EULA_EXTRABANNED_ERRORS: Errors = Errors{
+ error: &[
+ Error{
+ code: "0109",
+ message: "REREAD THE EULA LOL"
+ }
+ ]
};
#[derive(FromForm)]
-pub struct TokenRequestData<'a> {
+pub struct TokenRequestData<'a>{
grant_type: &'a str,
user_id: &'a str,
password: &'a str,
@@ -55,27 +55,17 @@ pub struct TokenRequestData<'a> {
pub struct TokenReturnData {
token: String,
refresh_token: String,
- expires_in: i32,
+ expires_in: i32
}
-pub async fn create_token(
- pool: &Pool,
- pid: i32,
- token_type: i32,
- title_id: Option<&str>,
- cert_hash: Option<&[u8]>,
-) -> String {
+pub async fn create_token(pool: &Pool, pid: i32, token_type: i32, title_id: Option<&str>) -> String{
let data = sqlx::query!(
- "insert into tokens (token_type, pid, title_id, cert_hash)
- values ($1, $2, $3, $4) returning token_id, random",
- token_type,
- pid,
- title_id,
- cert_hash
- )
- .fetch_one(pool)
- .await
- .unwrap();
+ "insert into tokens (token_type, pid, title_id)
+ values ($1, $2, $3) returning token_id, random",
+ token_type, pid, title_id
+ )
+ .fetch_one(pool)
+ .await.unwrap();
let token_id = data.token_id;
let random = data.random;
@@ -83,77 +73,61 @@ pub async fn create_token(
let token = TokenData {
token_id,
random,
- pid,
+ pid
};
token.encode().to_string()
}
+
impl TokenReturnData {
- async fn new(pid: i32, pool: &Pool) -> Self {
- let token = create_token(pool, pid, AUTH_TOKEN, None, None).await;
+ async fn new(pid: i32, pool: &Pool) -> Self{
+ let token = create_token(pool, pid, AUTH_TOKEN, None).await;
- let refresh_token = create_token(pool, pid, AUTH_REFRESH_TOKEN, None, None).await;
+ let refresh_token = create_token(pool, pid, AUTH_REFRESH_TOKEN, None).await;
- Self {
+ Self{
token,
refresh_token,
- expires_in: 3600,
- }
- }
- async fn new_with_cert(pid: i32, cert: Option<&[u8]>, pool: &Pool) -> Self {
- let token = create_token(pool, pid, AUTH_TOKEN, None, cert).await;
-
- let refresh_token = create_token(pool, pid, AUTH_REFRESH_TOKEN, None, cert).await;
-
- Self {
- token,
- refresh_token,
- expires_in: 3600,
+ expires_in: 3600
}
}
}
#[derive(Serialize)]
-#[serde(rename = "OAuth20")]
-pub struct TokenRequestReturnData {
- access_token: TokenReturnData,
+#[serde(rename="OAuth20")]
+pub struct TokenRequestReturnData{
+ access_token: TokenReturnData
}
-#[post("/v1/api/oauth20/access_token/generate", data = "")]
-pub async fn generate_token(
- pool: &State,
- data: Form>,
- cert: DeviceCert,
-) -> Result, Option>> {
+#[post("/v1/api/oauth20/access_token/generate", data="")]
+pub async fn generate_token(pool: &State, data: Form>, ip: CFIP, cert: DeviceCert) -> Result, Option>>{
let pool = pool.inner();
- let user = User::get_by_username(data.user_id, pool)
- .await
+ let user = User::get_by_username(data.user_id, pool).await
.ok_or(Some(ACCOUNT_ID_OR_PASSWORD_ERRORS))?;
- if !user
- .verify_hashed_password(&data.password)
- .is_some_and(|v| v)
- {
+ if !user.verify_hashed_password(&data.password).is_some_and(|v| v){
return Err(Some(ACCOUNT_ID_OR_PASSWORD_ERRORS));
}
- if user.eula_version != *LATEST_EULA_VERSION {
- return Err(Some(REREAD_EULA_ERRORS));
- }
-
- if user.account_level < 0 {
+ if user.account_level < 0{
if user.account_level == -2 {
- return Err(Some(ACCOUNT_TEMPBANNED_ERRORS));
+ return Err(Some(REREAD_EULA_EXTRABANNED_ERRORS));
+ }
+ if user.account_level == -3{
+ EVIL_AGREEMENT_THING.write().await.insert(ip.0);
+
+ return Err(Some(REREAD_EULA_EXTRABANNED_ERRORS));
}
return Err(Some(ACCOUNT_BANNED_ERRORS));
}
-
+
link_certificate_to_pid(&pool, &cert.0, user.pid).await?;
- let access_token =
- TokenReturnData::new_with_cert(user.pid, Some(&cert.0.hash()[..]), pool).await;
+ let access_token = TokenReturnData::new(user.pid, pool).await;
- Ok(Xml(TokenRequestReturnData { access_token }))
-}
+ Ok(Xml(TokenRequestReturnData{
+ access_token
+ }))
+}
\ No newline at end of file
diff --git a/src/nnid/people.rs b/src/nnid/people.rs
index c81b4b2..3c46925 100644
--- a/src/nnid/people.rs
+++ b/src/nnid/people.rs
@@ -1,31 +1,31 @@
#![allow(unused)]
-use crate::Pool;
-use crate::account::account::{Auth, User, generate_nex_password, generate_password};
-use crate::dsresponse::Ds;
-use crate::email::send_verification_email;
-use crate::error::{Error, Errors};
-use crate::mii_util::get_mii_img_url;
-use crate::nnid::timezones::OFFSET_FROM_TIMEZONE;
-use crate::xml::{Xml, YesNoVal};
use chrono::{NaiveDate, NaiveDateTime};
use gxhash::{gxhash32, gxhash64};
-use nex_account::grpc::{ActStageInfo, ActStageReturn};
-use nex_account::grpc_client;
-use rand::prelude::*;
+use rocket::{get, post, put, State};
use rocket::serde::{Deserialize, Serialize};
-use rocket::request::{FromRequest, Outcome, Request};
-use rocket::{State, get, post, put};
+use crate::account::account::{Auth, User, generate_nex_password, generate_password};
+use crate::dsresponse::Ds;
+use crate::error::{Error, Errors};
+use crate::nnid::pid_distribution::next_pid;
+use crate::nnid::timezones::{OFFSET_FROM_TIMEZONE};
+use crate::Pool;
+use crate::xml::{Xml, YesNoVal};
+use crate::email::send_verification_email;
+use rand::prelude::*;
+use crate::mii_util::get_mii_img_url;
-const DATABASE_ERROR: Errors = Errors {
- error: &[Error {
- code: "2001",
- message: "Internal server error",
- }],
+const DATABASE_ERROR: Errors = Errors{
+ error: &[
+ Error{
+ code: "9999",
+ message: "Internal server error"
+ }
+ ]
};
#[derive(Deserialize)]
-pub struct Email {
- address: Box,
+pub struct Email{
+ address: Box
}
#[derive(Deserialize)]
@@ -36,7 +36,7 @@ pub struct UpdateMiiData {
}
#[derive(Deserialize, Serialize)]
-pub struct Mii {
+pub struct Mii{
name: Box,
primary: YesNoVal,
data: Box,
@@ -44,7 +44,7 @@ pub struct Mii {
#[derive(Deserialize)]
#[serde(rename(serialize = "person"))]
-pub struct AccountCreationData {
+pub struct AccountCreationData{
birth_date: NaiveDate,
user_id: Box,
password: Box,
@@ -56,99 +56,24 @@ pub struct AccountCreationData {
gender: Box,
marketing_flag: YesNoVal,
off_device_flag: YesNoVal,
- region: i32,
+ region: i32
}
#[derive(Serialize)]
#[serde(rename(serialize = "person"))]
-pub struct AccountCreationResponseData {
- pid: i32,
+pub struct AccountCreationResponseData{
+ pid: i32
}
-#[derive(Serialize)]
-#[serde(rename = "device")]
-pub struct DeviceInfo {
- pub device_id: String,
- pub language: String,
- pub updated: NaiveDateTime,
- pub pid: i32,
- pub platform_id: String,
- pub region: String,
- pub serial_number: String,
- pub status: String,
- pub system_version: String,
- pub r#type: String,
- pub updated_by: String,
-}
-
-#[derive(Serialize)]
-pub struct DevicesWrapper {
- #[serde(rename = "device")]
- pub devices: Vec,
-}
-
-#[derive(Serialize)]
-pub struct EmptyDeviceResponse {
- pub device: String,
-}
-
-#[derive(Deserialize)]
-#[serde(rename = "person")]
-pub struct UpdateAccountData {
- pub gender: Option>,
- pub region: Option,
- pub country: Option>,
- pub language: Option>,
- pub tz_name: Option>,
- pub marketing_flag: Option,
- pub off_device_flag: Option,
- pub password: Option>,
-}
-
-#[derive(Serialize)]
-pub struct EmailWrapper {
- pub email: EmailInfoOwnProfileData,
-}
-
-#[derive(Serialize)]
-pub struct EmailsWrapper {
- #[serde(rename = "email")]
- pub emails: Vec,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateEmailData {
- pub address: Box,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateEmailRequest {
- pub email: UpdateEmailData,
-}
-
-#[post("/v1/api/people", data = "")]
-pub async fn create_account(
- database: &State,
- data: Xml,
-) -> Result, Option>> {
+#[post("/v1/api/people", data="")]
+pub async fn create_account(database: &State, data: Xml) -> Result, Option>>{
let database = database.inner();
- let nex_password = generate_nex_password();
-
- let mut client = grpc_client().await.expect("unable to connect to grpc");
-
- let Ok(ret) = client
- .stage_new_account(ActStageInfo {
- password: nex_password.clone().into_bytes(),
- })
- .await
- else {
- return Err(Some(DATABASE_ERROR));
- };
- let ActStageReturn { pid, .. } = ret.into_inner();
// its fine to crash here if we cant get the next pid as that is in my opinion a dead state
// anyways as noone can register anymore, EVER
+ let pid = next_pid(database).await;
+
let verification_code: i32 = rand::rng().random_range(100_000..1_000_000);
let AccountCreationData {
@@ -157,8 +82,14 @@ pub async fn create_account(
birth_date,
tz_name,
language,
- email: Email { address },
- mii: Mii { name, data, .. },
+ email: Email{
+ address
+ },
+ mii: Mii{
+ name,
+ data,
+ ..
+ },
marketing_flag,
gender,
region,
@@ -167,16 +98,17 @@ pub async fn create_account(
..
} = data.0;
- let account_level = if user_id.to_lowercase().contains("omey") {
+ let account_level = if user_id.to_lowercase().contains("omey"){
-1
} else {
0
};
- let password = generate_password(pid, &password).ok_or(None)?;
- sqlx::query!(
- "
+ let password = generate_password(pid, &password).ok_or(None)?;
+ let nex_password = generate_nex_password();
+
+ sqlx::query!("
INSERT INTO users (
pid,
username,
@@ -214,20 +146,19 @@ pub async fn create_account(
verification_code,
account_level,
nex_password
- )
- .execute(database)
- .await
- .unwrap();
+ ).execute(database).await.unwrap();
//generate_s3_images(pid, &data).await;
- if let Err(e) =
- send_verification_email(address.as_ref(), verification_code, user_id.as_ref()).await
- {
+ if let Err(e) = send_verification_email(address.as_ref(), verification_code, user_id.as_ref()).await {
println!("Failed to send verification email: {e}");
}
- Ok(Xml(AccountCreationResponseData { pid }))
+ Ok(
+ Xml(AccountCreationResponseData{
+ pid
+ })
+ )
}
// #[derive(Serialize)]
@@ -236,21 +167,21 @@ pub async fn create_account(
// }
#[derive(Serialize)]
-pub struct EmailInfoOwnProfileData {
- pub address: String,
- pub id: u32,
- pub parent: YesNoVal,
- pub primary: YesNoVal,
- pub reachable: YesNoVal,
+struct EmailInfoOwnProfileData{
+ address: String,
+ id: u32,
+ parent: YesNoVal,
+ primary: YesNoVal,
+ reachable: YesNoVal,
#[serde(rename = "type")]
- pub email_type: String,
- pub updated_by: String,
- pub validated: YesNoVal,
- pub validated_date: Option,
+ email_type: String,
+ updated_by: String,
+ validated: YesNoVal,
+ validated_date: Option
}
#[derive(Serialize)]
-struct EmailInfoOwnOAuthProfileData {
+struct EmailInfoOwnOAuthProfileData{
address: String,
id: u32,
parent: bool,
@@ -260,37 +191,40 @@ struct EmailInfoOwnOAuthProfileData {
email_type: String,
updated_by: String,
validated: bool,
- validated_date: Option,
+ validated_date: Option
}
#[derive(Serialize)]
-struct MiiImage {
+struct MiiImage{
cached_url: String,
id: u32,
url: String,
#[serde(rename = "type")]
- image_type: String,
+ image_type: String
+}
+
+
+#[derive(Serialize)]
+struct MiiImages{
+ mii_image: MiiImage
}
#[derive(Serialize)]
-struct MiiImages {
- mii_image: MiiImage,
-}
-
-#[derive(Serialize)]
-struct MiiDataOwnProfileData {
+struct MiiDataOwnProfileData{
status: String,
data: String,
id: u32,
mii_hash: String,
mii_images: MiiImages,
name: String,
- primary: YesNoVal,
+ primary: YesNoVal
}
+
+
#[derive(Serialize)]
#[serde(rename(serialize = "person"))]
-pub struct GetOwnProfileData {
+pub struct GetOwnProfileData{
active_flag: YesNoVal,
birth_date: NaiveDate,
country: String,
@@ -312,7 +246,7 @@ pub struct GetOwnProfileData {
#[derive(Serialize)]
#[serde(rename(serialize = "person"))]
-pub struct GetOwnOAuthProfileData {
+pub struct GetOwnOAuthProfileData{
active_flag: bool,
birth_date: NaiveDate,
country: String,
@@ -336,17 +270,17 @@ pub struct GetOwnOAuthProfileData {
}
#[get("/v1/api/people/@me/profile")]
-pub fn get_own_profile(user: Auth) -> Ds> {
+pub fn get_own_profile(user: Auth) -> Ds>{
Ds(Xml(build_profile(user.into())))
}
#[get("/v1/api/people/@me/devices/owner")]
-pub fn get_device_owner(user: Auth) -> Ds> {
+pub fn get_device_owner(user: Auth) -> Ds>{
Ds(Xml(build_profile(user.into())))
}
#[post("/v1/api/people/@me/devices")]
-pub fn get_own_device(user: Auth) -> Ds> {
+pub fn get_own_device(user: Auth) -> Ds>{
Ds(Xml(build_profile(user.into())))
}
@@ -380,58 +314,59 @@ pub fn build_profile(user: User) -> GetOwnProfileData {
.replace("\r", "")
.replace(" ", "");
- GetOwnProfileData {
- active_flag: YesNoVal(true),
- pid,
- user_id: username,
- gender,
- birth_date: birthdate,
- country,
- create_date: creation_date,
- tz_name: timezone,
- language,
- updated,
- marketing_flag: YesNoVal(marketing_allowed),
- email: EmailInfoOwnProfileData {
- id: gxhash32(email.as_bytes(), 0),
- address: email,
- validated: YesNoVal(email_verified_since.is_some()),
- validated_date: email_verified_since,
- email_type: "DEFAULT".to_string(),
- updated_by: "USER".to_string(),
- reachable: YesNoVal(true),
- primary: YesNoVal(true),
- parent: YesNoVal(false),
- },
- mii: MiiDataOwnProfileData {
- id: gxhash32(mii_data.as_bytes(), 0),
- mii_hash: hex::encode(bytemuck::bytes_of(
- &(gxhash64(mii_data.as_bytes(), 1) & !(0x1000000000000000)),
- )),
- name: crate::mii_util::MiiData::read(&mii_data)
+
+ GetOwnProfileData {
+ active_flag: YesNoVal(true),
+ pid,
+ user_id: username,
+ gender,
+ birth_date: birthdate,
+ country,
+ create_date: creation_date,
+ tz_name: timezone,
+ language,
+ updated,
+ marketing_flag: YesNoVal(marketing_allowed),
+ email: EmailInfoOwnProfileData {
+ id: gxhash32(email.as_bytes(), 0),
+ address: email,
+ validated: YesNoVal(email_verified_since.is_some()),
+ validated_date: email_verified_since,
+ email_type: "DEFAULT".to_string(),
+ updated_by: "USER".to_string(),
+ reachable: YesNoVal(true),
+ primary: YesNoVal(true),
+ parent: YesNoVal(false),
+ },
+ mii: MiiDataOwnProfileData {
+ id: gxhash32(mii_data.as_bytes(), 0),
+ mii_hash: hex::encode(bytemuck::bytes_of(
+ &(gxhash64(mii_data.as_bytes(), 1) & !(0x1000000000000000))
+ )),
+ name: crate::mii_util::MiiData::read(&mii_data)
.map(|v| v.name)
.unwrap_or_else(|| "INVALID".to_string()),
- primary: YesNoVal(true),
- data: mii_data,
- status: "COMPLETED".to_string(),
- mii_images: MiiImages {
- mii_image: {
- let image_url = get_mii_img_url(pid, "tga");
- let url_hash = gxhash32(image_url.as_bytes(), 0);
- MiiImage {
- image_type: "standard".to_string(),
- id: url_hash,
- url: image_url.clone(),
- cached_url: image_url,
+ primary: YesNoVal(true),
+ data: mii_data,
+ status: "COMPLETED".to_string(),
+ mii_images: MiiImages {
+ mii_image: {
+ let image_url = get_mii_img_url(pid, "tga");
+ let url_hash = gxhash32(image_url.as_bytes(), 0);
+ MiiImage {
+ image_type: "standard".to_string(),
+ id: url_hash,
+ url: image_url.clone(),
+ cached_url: image_url,
+ }
}
- },
+ }
},
- },
- off_device_flag: YesNoVal(off_device_allowed),
- region,
- utc_offset: timezone_offset,
- account_level,
- }
+ off_device_flag: YesNoVal(off_device_allowed),
+ region,
+ utc_offset: timezone_offset,
+ account_level,
+ }
}
pub fn build_oauth_profile(user: User) -> GetOwnOAuthProfileData {
@@ -469,61 +404,62 @@ pub fn build_oauth_profile(user: User) -> GetOwnOAuthProfileData {
.replace("\r", "")
.replace(" ", "");
- GetOwnOAuthProfileData {
- id,
- sub,
- uid,
- active_flag: true,
- pid,
- user_id: username,
- gender,
- birth_date: birthdate,
- country,
- create_date: creation_date,
- tz_name: timezone,
- language,
- updated,
- marketing_flag: marketing_allowed,
- email: EmailInfoOwnOAuthProfileData {
- id: gxhash32(email.as_bytes(), 0),
- address: email,
- validated: email_verified_since.is_some(),
- validated_date: email_verified_since,
- email_type: "DEFAULT".to_string(),
- updated_by: "USER".to_string(),
- reachable: true,
- primary: true,
- parent: false,
- },
- mii: MiiDataOwnProfileData {
- id: gxhash32(mii_data.as_bytes(), 0),
- mii_hash: hex::encode(bytemuck::bytes_of(
- &(gxhash64(mii_data.as_bytes(), 1) & !(0x1000000000000000)),
- )),
- name: crate::mii_util::MiiData::read(&mii_data)
+
+ GetOwnOAuthProfileData {
+ id,
+ sub,
+ uid,
+ active_flag: true,
+ pid,
+ user_id: username,
+ gender,
+ birth_date: birthdate,
+ country,
+ create_date: creation_date,
+ tz_name: timezone,
+ language,
+ updated,
+ marketing_flag: marketing_allowed,
+ email: EmailInfoOwnOAuthProfileData {
+ id: gxhash32(email.as_bytes(), 0),
+ address: email,
+ validated: email_verified_since.is_some(),
+ validated_date: email_verified_since,
+ email_type: "DEFAULT".to_string(),
+ updated_by: "USER".to_string(),
+ reachable: true,
+ primary: true,
+ parent: false,
+ },
+ mii: MiiDataOwnProfileData {
+ id: gxhash32(mii_data.as_bytes(), 0),
+ mii_hash: hex::encode(bytemuck::bytes_of(
+ &(gxhash64(mii_data.as_bytes(), 1) & !(0x1000000000000000))
+ )),
+ name: crate::mii_util::MiiData::read(&mii_data)
.map(|v| v.name)
.unwrap_or_else(|| "INVALID".to_string()),
- primary: YesNoVal(true),
- data: mii_data,
- status: "COMPLETED".to_string(),
- mii_images: MiiImages {
- mii_image: {
- let image_url = get_mii_img_url(pid, "png");
- let url_hash = gxhash32(image_url.as_bytes(), 0);
- MiiImage {
- image_type: "standard".to_string(),
- id: url_hash,
- url: image_url.clone(),
- cached_url: image_url,
+ primary: YesNoVal(true),
+ data: mii_data,
+ status: "COMPLETED".to_string(),
+ mii_images: MiiImages {
+ mii_image: {
+ let image_url = get_mii_img_url(pid, "png");
+ let url_hash = gxhash32(image_url.as_bytes(), 0);
+ MiiImage {
+ image_type: "standard".to_string(),
+ id: url_hash,
+ url: image_url.clone(),
+ cached_url: image_url,
+ }
}
- },
+ }
},
- },
- off_device_flag: off_device_allowed,
- region,
- utc_offset: timezone_offset,
- account_level,
- }
+ off_device_flag: off_device_allowed,
+ region,
+ utc_offset: timezone_offset,
+ account_level,
+ }
}
#[put("/v1/api/people/@me/miis/@primary", data = "")]
@@ -543,8 +479,8 @@ pub async fn change_mii(
mii_data,
pid
)
- .execute(db)
- .await;
+ .execute(db)
+ .await;
if let Err(e) = result {
println!("Failed to update Mii data for PID {}: {:?}", pid, e);
@@ -556,245 +492,8 @@ pub async fn change_mii(
Ok(())
}
-#[derive(Deserialize, Debug)]
-pub struct AgreedEulaData {
- pub agreement_date: NaiveDateTime,
- pub country: Box,
- pub location: Box,
- pub version: i32
+
+#[post("/v1/api/people/@me/agreements")]
+pub async fn thing(){
+
}
-
-#[post("/v1/api/people/@me/agreements", data = "")]
-pub async fn thing(
- database: &State,
- auth: Auth,
- data: Xml,
-) -> Result<(), Option>> {
- let db = database.inner();
- let version = data.version;
- let pid = auth.pid;
- println!("eula data: {:?}", data.version);
-
- let result = sqlx::query!(
- "UPDATE users SET eula_version = $1 WHERE pid = $2",
- version,
- pid
- )
- .execute(db)
- .await;
-
- if let Err(e) = result {
- println!("Failed to update EULA version for PID {}: {:?}", pid, e);
- return Err(Some(DATABASE_ERROR));
- }
-
- Ok(())
-}
-
-pub struct DeviceHeaders {
- pub device_id: String,
- pub accept_language: String,
- pub platform_id: String,
- pub region: String,
- pub serial_number: String,
- pub system_version: String,
-}
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for DeviceHeaders {
- type Error = Errors<'static>;
-
- async fn from_request(req: &'r Request<'_>) -> Outcome {
- let headers = req.headers();
-
- let get_h = |key: &str| headers.get_one(key).map(|s| s.to_string());
-
- match (
- get_h("x-nintendo-device-id"),
- get_h("accept-language"),
- get_h("x-nintendo-platform-id"),
- get_h("x-nintendo-region"),
- get_h("x-nintendo-serial-number"),
- get_h("x-nintendo-system-version"),
- ) {
- (
- Some(device_id),
- Some(accept_language),
- Some(platform_id),
- Some(region),
- Some(serial_number),
- Some(system_version),
- ) => Outcome::Success(DeviceHeaders {
- device_id,
- accept_language,
- platform_id,
- region,
- serial_number,
- system_version,
- }),
- _ => Outcome::Error((
- rocket::http::Status::BadRequest,
- Errors {
- error: &[Error {
- code: "1600",
- message: "Unable to process request",
- }],
- },
- )),
- }
- }
-}
-
-#[get("/v1/api/people/@me/devices")]
-pub fn get_user_devices(
- auth: Auth,
- headers: DeviceHeaders,
-) -> Xml {
- let now = chrono::Utc::now().naive_utc();
-
- Xml(DevicesWrapper {
- devices: vec![DeviceInfo {
- device_id: headers.device_id,
- language: headers.accept_language,
- updated: now,
- pid: auth.pid,
- platform_id: headers.platform_id,
- region: headers.region,
- serial_number: headers.serial_number,
- status: "ACTIVE".to_string(),
- system_version: headers.system_version,
- r#type: "RETAIL".to_string(),
- updated_by: "USER".to_string(),
- }],
- })
-}
-
-#[get("/v1/api/people/@me/devices/status")]
-pub fn get_device_status(_auth: Auth) -> Xml {
- Xml(EmptyDeviceResponse {
- device: String::new(),
- })
-}
-
-#[put("/v1/api/people/@me/devices/@current/inactivate")]
-pub fn inactivate_current_device(_auth: Auth) -> () {
- // just 200
-}
-
-#[post("/v1/api/people/@me/deletion")]
-pub async fn delete_account(
- database: &State,
- auth: Auth,
-) -> Result<(), Option>> {
- let db = database.inner();
-
- let result = sqlx::query!(
- "DELETE FROM users WHERE pid = $1",
- auth.pid
- )
- .execute(db)
- .await;
-
- if let Err(e) = result {
- println!("failed to delete PID {}: {:?}", auth.pid, e);
- return Err(Some(DATABASE_ERROR));
- }
-
- Ok(())
-}
-
-#[put("/v1/api/people/@me", data = "")]
-pub async fn update_account(
- database: &State,
- auth: Auth,
- data: Xml,
-) -> Result<(), Option>> {
- let db = database.inner();
- let pid = auth.pid;
- let data = data.0;
-
- let updated_password = if let Some(ref new_pass) = data.password {
- generate_password(pid, new_pass)
- } else {
- None
- };
-
- let result = sqlx::query!(
- "
- UPDATE users SET
- gender = COALESCE($1, gender),
- region = COALESCE($2, region),
- country = COALESCE($3, country),
- language = COALESCE($4, language),
- timezone = COALESCE($5, timezone),
- marketing_allowed = COALESCE($6, marketing_allowed),
- off_device_allowed = COALESCE($7, off_device_allowed),
- password = COALESCE($8, password)
- WHERE pid = $9
- ",
- data.gender.as_deref(),
- data.region,
- data.country.as_deref(),
- data.language.as_deref(),
- data.tz_name.as_deref(),
- data.marketing_flag.map(|v| v.0),
- data.off_device_flag.map(|v| v.0),
- updated_password,
- pid
- )
- .execute(db)
- .await;
-
- if let Err(e) = result {
- println!("failed to update account for PID {}: {:?}", pid, e);
- return Err(Some(DATABASE_ERROR));
- }
-
- Ok(())
-}
-
-#[get("/v1/api/people/@me/emails")]
-pub fn get_own_emails(user: Auth) -> Xml {
- let profile = build_profile(user.into());
- Xml(EmailsWrapper {
- emails: vec![profile.email],
- })
-}
-
-#[put("/v1/api/people/@me/emails/@primary", data = "")]
-pub async fn update_primary_email(
- database: &State,
- auth: Auth,
- data: Xml,
-) -> Result<(), Option>> {
- let db = database.inner();
- let pid = auth.pid;
- let new_address = data.0.email.address.to_lowercase();
- let verification_code: i32 = rand::rng().random_range(100_000..1_000_000);
-
- let result = sqlx::query!(
- "
- UPDATE users SET
- email = $1,
- email_verified_since = NULL,
- verification_code = $2
- WHERE pid = $3
- ",
- new_address,
- verification_code,
- pid
- )
- .execute(db)
- .await;
-
- if let Err(e) = result {
- println!("failed to update email for PID {}: {:?}", pid, e);
- return Err(Some(DATABASE_ERROR));
- }
-
- if let Err(e) = send_verification_email(&new_address, verification_code, &auth.username).await {
- println!("failed to send verification email: {e}");
- }
-
- Ok(())
-}
\ No newline at end of file
diff --git a/src/nnid/pid_distribution.rs b/src/nnid/pid_distribution.rs
index 4e7c48b..eb6ad00 100644
--- a/src/nnid/pid_distribution.rs
+++ b/src/nnid/pid_distribution.rs
@@ -1,6 +1,5 @@
-#![deprecated = "handled by nex-account now"]
-/*
use crate::Pool;
+
pub async fn next_pid(pool: &Pool) -> i32{
loop {
let next_pid = sqlx::query!("SELECT nextval('pid_counter') as pid")
@@ -27,5 +26,4 @@ pub async fn next_pid(pool: &Pool) -> i32{
-}
-*/
+}
\ No newline at end of file
diff --git a/src/nnid/provider.rs b/src/nnid/provider.rs
index 316d003..96809f1 100644
--- a/src/nnid/provider.rs
+++ b/src/nnid/provider.rs
@@ -1,112 +1,69 @@
-use crate::Pool;
+use std::net::Ipv4Addr;
+use rocket::{get, State};
+use serde::Serialize;
+use sqlx::types::ipnetwork::IpNetwork::V4;
use crate::account::account::Auth;
use crate::error::{Error, Errors};
-use crate::nnid::oauth::generate_token::create_token;
+use crate::nnid::oauth::generate_token::{create_token};
use crate::nnid::oauth::generate_token::token_type::NEX_TOKEN;
+use crate::Pool;
use crate::xml::Xml;
-use log::{info, warn};
-use nex_account::grpc::Pid;
-use rocket::http::Status;
-use rocket::request::{FromRequest, Outcome, Request};
-use rocket::{State, async_trait, get};
-use serde::Serialize;
-use sqlx::query;
-use sqlx::types::ipnetwork::IpNetwork::V4;
-use std::net::Ipv4Addr;
-const NO_IPV4_ERROR: Errors = Errors {
- error: &[Error {
- code: "1022",
- message: "Server is not a valid IPv4 address",
- }],
+const NO_IPV4_ERROR: Errors = Errors{
+ error: &[
+ Error{
+ code: "1022",
+ message: "Server is not a valid IPv4 address"
+ }
+ ]
};
-const SERVER_ERROR: Errors = Errors {
- error: &[Error {
- code: "9999",
- message: "Internal Server Error",
- }],
+const SERVER_ERROR: Errors = Errors{
+ error: &[
+ Error{
+ code: "9999",
+ message: "Internal Server Error"
+ }
+ ]
};
-const NO_SERVER_ERROR: Errors = Errors {
- error: &[Error {
- code: "1021",
- message: "The requested game server was not found",
- }],
+const NO_SERVER_ERROR: Errors = Errors{
+ error: &[
+ Error{
+ code: "1021",
+ message: "The requested game server was not found"
+ }
+ ]
};
-const MAINTENANCE_ERROR: Errors = Errors {
- error: &[Error {
- code: "2002",
- message: "The requested game server is under maintenance",
- }],
+const MAINTENANCE_ERROR: Errors = Errors{
+ error: &[
+ Error{
+ code: "2002",
+ message: "The requested game server is under maintenance"
+ }
+ ]
};
+
#[derive(Serialize)]
#[serde(rename = "nex_token")]
-pub struct NexToken {
+pub struct NexToken{
host: Ipv4Addr,
nex_password: String,
pid: i32,
port: u16,
- token: Box,
+ token: String
}
#[derive(Serialize)]
#[serde(rename = "service_token")]
-pub struct ServiceToken {
- token: String,
-}
-
-pub async fn store_or_check_serial(pool: &Pool, serial: &str, cert_hash: [u8; 32]) -> bool {
- let Ok(res) = query!(
- "select serial from certificates where hash = $1",
- &cert_hash[..]
- )
- .fetch_one(pool)
- .await
- else {
- warn!(
- "user tried to access a route which is locked behind a console asociated token without a console token"
- );
- return false;
- };
-
- let Some(stored_serial) = res.serial else {
- let _row = query!(
- "update certificates set serial = $1 where hash = $2",
- serial,
- &cert_hash[..]
- ).execute(pool)
- .await
- .ok();
- return true;
- };
-
- serial == stored_serial
-}
-
-pub struct Serial(pub String);
-
-#[async_trait]
-impl<'r> FromRequest<'r> for Serial {
- type Error = Errors<'static>;
- async fn from_request(request: &'r Request<'_>) -> Outcome {
- let Some(header) = request.headers().get("X-Nintendo-Serial-Number").next() else {
- warn!("serial number wasnt sent on request which expected a serial number");
- return Outcome::Error((Status::BadRequest, SERVER_ERROR));
- };
-
- Outcome::Success(Self(header.to_owned()))
- }
+pub struct ServiceToken{
+ token: String
}
#[get("/v1/api/provider/service_token/@me")]
-pub async fn get_service_token(
- pool: &State,
- auth: Auth,
- serial: Serial,
-) -> Result, Option>> {
+pub async fn get_service_token(pool: &State, auth: Auth) -> Result, Option>>{
// just gonna put this here as a side note for the future:
// we could also be using key derivation to derive the nex token as if it were a key
// that way we could reduce the data the database needs to store and also reduce the transfer
@@ -116,27 +73,19 @@ pub async fn get_service_token(
let pool = pool.inner();
- let Some(cert_hash) = auth.1 else {
- info!("attempt to generate service token using non wii u/certificate token");
- return Err(Some(SERVER_ERROR));
- };
+ let token = create_token(pool, auth.pid, NEX_TOKEN, None).await;
- if !store_or_check_serial(pool, &serial.0, cert_hash).await {
- info!("serial mismatched with certificate");
- return Err(Some(SERVER_ERROR));
- }
-
- let token = create_token(pool, auth.pid, NEX_TOKEN, None, Some(&cert_hash[..])).await;
-
- Ok(Xml(ServiceToken { token }))
+ Ok(
+ Xml(
+ ServiceToken{
+ token
+ }
+ )
+ )
}
#[get("/v1/api/provider/nex_token/@me?")]
-pub async fn get_nex_token(
- pool: &State,
- auth: Auth,
- game_server_id: &str,
-) -> Result, Option>> {
+pub async fn get_nex_token(pool: &State, auth: Auth, game_server_id: &str) -> Result, Option>>{
// just gonna put this here as a side note for the future:
// we could also be using key derivation to derive the nex token as if it were a key
// that way we could reduce the data the database needs to store and also reduce the transfer
@@ -159,40 +108,28 @@ pub async fn get_nex_token(
Some(row) => row,
None => return Err(Some(NO_SERVER_ERROR)),
}; // only crash on db failure (not missing row)
-
+
if server.maintenance_mode {
- return Err(Some(MAINTENANCE_ERROR));
+ return Err(Some(MAINTENANCE_ERROR))
}
+ let token = create_token(pool, auth.pid, NEX_TOKEN, None).await;
+
let V4(host) = server.address else {
return Err(Some(NO_IPV4_ERROR));
};
let host = host.ip();
- let mut client = nex_account::grpc_client().await.unwrap();
- let Ok(key) = client
- .get_nex_key_by_pid_maybe_staged(Pid { pid: auth.pid })
- .await
- else {
- println!("account does not exist on nex-account server");
- return Err(Some(SERVER_ERROR));
- };
-
- let token = nex_account::gen_nexact_token(
- auth.pid,
- key.into_inner()
- .key
- .try_into()
- .map_err(|_| Some(SERVER_ERROR))?,
+ Ok(
+ Xml(
+ NexToken{
+ host,
+ port: server.port as u16,
+ nex_password: auth.nex_password.clone(),
+ pid: auth.pid,
+ token
+ }
+ )
)
- .expect("NEX_ACCOUNT_KEYPAIR not set");
-
- Ok(Xml(NexToken {
- host,
- port: server.port as u16,
- nex_password: auth.nex_password.clone(),
- pid: auth.pid,
- token,
- }))
}
diff --git a/src/nnid/support.rs b/src/nnid/support.rs
index f119ef9..715ca1c 100644
--- a/src/nnid/support.rs
+++ b/src/nnid/support.rs
@@ -6,8 +6,6 @@ use rocket::form::Form;
use rocket::{FromForm, State, post, put, get, Request};
use rocket::request::{self, FromRequest};
use rocket::http::Status;
-use rand::RngExt;
-use rand::distr::Alphanumeric;
const BAD_CODE_ERROR: Errors = Errors {
error: &[Error {
@@ -16,13 +14,6 @@ const BAD_CODE_ERROR: Errors = Errors {
}],
};
-const UNAUTHORIZED_DEVICE_ERROR: Errors = Errors {
- error: &[Error {
- code: "0113",
- message: "Unauthorized device",
- }],
-};
-
#[derive(FromForm)]
pub struct ValidateEmailInput {
email: String,
@@ -54,6 +45,7 @@ pub async fn validate(
let email = data.email.trim();
+ // 1. Validate presence + basic format
if email.is_empty() || !email.contains('@') {
return Err(Errors {
error: &[Error {
@@ -63,6 +55,7 @@ pub async fn validate(
});
}
+ // 2. Extract domain safely
let domain = match email.split('@').nth(1) {
Some(d) if !d.is_empty() => d,
_ => {
@@ -75,7 +68,7 @@ pub async fn validate(
}
};
- // This shouldn't ever fail unless there's something wrong with the server
+ // 3. DNS resolver
let resolver = TokioAsyncResolver::tokio_from_system_conf()
.map_err(|_| Errors {
error: &[Error {
@@ -84,6 +77,7 @@ pub async fn validate(
}],
})?;
+ // 4. MX lookup
match resolver.mx_lookup(domain).await {
Ok(mx) if mx.iter().next().is_some() => Ok(()),
@@ -165,165 +159,5 @@ pub async fn resend_email(
BAD_CODE_ERROR
})?;
- Ok(())
-}
-
-#[get("/v1/api/support/forgotten_password/")]
-pub async fn forgotten_password(
- database: &State,
- pid: i32,
-) -> Result<(), Errors<'static>> {
- let db = database.inner();
-
- let user_data = sqlx::query!(
- "SELECT username, email FROM users WHERE pid = $1",
- pid
- )
- .fetch_optional(db)
- .await
- .map_err(|e| {
- eprintln!("database lookup error: {e}");
- UNAUTHORIZED_DEVICE_ERROR
- })?;
-
- let user = match user_data {
- Some(u) => u,
- None => return Err(UNAUTHORIZED_DEVICE_ERROR),
- };
-
- let cleartext_password: String = rand::rng()
- .sample_iter(&Alphanumeric)
- .take(10)
- .map(char::from)
- .collect();
-
- let nintendo_hash = crate::account::account::generate_password(pid, &cleartext_password)
- .ok_or(UNAUTHORIZED_DEVICE_ERROR)?;
-
- let update_result = sqlx::query!(
- "UPDATE users SET password = $1 WHERE pid = $2",
- nintendo_hash,
- pid
- )
- .execute(db)
- .await;
-
- if let Err(e) = update_result {
- eprintln!("failed to update password for PID {pid}: {e}");
- return Err(UNAUTHORIZED_DEVICE_ERROR);
- }
-
- crate::email::send_reset_email(&user.email, &cleartext_password, &user.username)
- .await
- .map_err(|e| {
- eprintln!("failed to send reset email: {e}");
- UNAUTHORIZED_DEVICE_ERROR
- })?;
-
- Ok(())
-}
-
-pub struct DeviceSerial(pub String);
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for DeviceSerial {
- type Error = Errors<'static>;
-
- async fn from_request(req: &'r Request<'_>) -> request::Outcome {
- match req.headers().get_one("x-nintendo-serial-number") {
- Some(val) if !val.trim().is_empty() => {
- request::Outcome::Success(DeviceSerial(val.to_string()))
- }
- _ => request::Outcome::Error((
- Status::BadRequest,
- Errors {
- error: &[Error {
- code: "0130",
- message: "Serial not found",
- }],
- },
- )),
- }
- }
-}
-
-#[get("/v1/api/support/send_confirmation/pin/")]
-pub async fn send_parental_controls_pin(
- database: &State,
- serial: DeviceSerial,
- email: &str,
-) -> Result<(), Errors<'static>> {
- let db = database.inner();
- let serial_number = serial.0;
- let email = email.trim().to_lowercase();
-
- if email.is_empty() || !email.contains('@') {
- return Err(Errors {
- error: &[Error {
- code: "0103",
- message: "Email format is invalid",
- }],
- });
- }
-
- let db_result = sqlx::query!(
- "
- INSERT INTO device_parental_controls (serial_number, email, updated_at)
- VALUES ($1, $2, NOW())
- ON CONFLICT (serial_number)
- DO UPDATE SET email = EXCLUDED.email, updated_at = NOW()
- ",
- serial_number,
- email
- )
- .execute(db)
- .await;
-
- if let Err(e) = db_result {
- eprintln!("Failed to associate serial {serial_number} with email {email}: {e}");
- return Err(Errors {
- error: &[Error {
- code: "0130",
- message: "PID has not been registered yet",
- }],
- });
- }
-
- crate::email::send_pc_email(&email, &serial_number)
- .await
- .map_err(|e| {
- eprintln!("Failed to send parental controls email to {email}: {e}");
- Errors {
- error: &[Error {
- code: "0130",
- message: "PID has not been registered yet",
- }],
- }
- })?;
-
- Ok(())
-}
-
-#[get("/v1/api/support/send_forgotten/pin//")]
-pub async fn send_forgotten_pin(
- serial: DeviceSerial,
- email: &str,
- master_key: &str,
-) -> Result<(), Errors<'static>> {
- let serial_number = serial.0;
- let email = email.trim().to_lowercase();
-
- crate::email::send_reset_pin_email(&email, &serial_number, &master_key)
- .await
- .map_err(|e| {
- eprintln!("Failed to send parental controls email to {email}: {e}");
- Errors {
- error: &[Error {
- code: "0130",
- message: "PID has not been registered yet",
- }],
- }
- })?;
-
Ok(())
}
\ No newline at end of file
|
