alps/server.go

445 lines
9.8 KiB
Go
Raw Normal View History

2020-05-13 12:07:44 +00:00
package alps
2019-12-02 14:31:00 +00:00
import (
"encoding/json"
2019-12-02 16:24:19 +00:00
"fmt"
"log"
2019-12-02 14:31:00 +00:00
"net/http"
2019-12-02 16:24:19 +00:00
"net/url"
2019-12-03 12:07:25 +00:00
"strings"
"sync"
2019-12-02 16:24:19 +00:00
"time"
2019-12-02 14:31:00 +00:00
"github.com/fernet/fernet-go"
2020-05-20 17:08:06 +00:00
"github.com/labstack/echo/v4"
2019-12-02 14:31:00 +00:00
)
const (
cookieName = "alps_session"
loginTokenCookieName = "alps_login_token"
)
2019-12-02 16:24:19 +00:00
2020-05-13 12:07:44 +00:00
// Server holds all the alps server state.
2019-12-02 16:24:19 +00:00
type Server struct {
e *echo.Echo
Sessions *SessionManager
Options *Options
mutex sync.RWMutex // used for server reload
plugins []Plugin
2019-12-09 17:16:27 +00:00
// maps protocols to URLs (protocol can be empty for auto-discovery)
upstreams map[string]*url.URL
2019-12-02 16:24:19 +00:00
imap struct {
2019-12-03 10:12:26 +00:00
host string
tls bool
2019-12-02 16:24:19 +00:00
insecure bool
}
2019-12-03 14:21:59 +00:00
smtp struct {
host string
tls bool
insecure bool
}
2019-12-02 16:24:19 +00:00
}
func newServer(e *echo.Echo, options *Options) (*Server, error) {
s := &Server{e: e, Options: options}
s.upstreams = make(map[string]*url.URL, len(options.Upstreams))
for _, upstream := range options.Upstreams {
u, err := parseUpstream(upstream)
if err != nil {
return nil, fmt.Errorf("failed to parse upstream %q: %v", upstream, err)
}
if _, ok := s.upstreams[u.Scheme]; ok {
return nil, fmt.Errorf("found two upstream servers for scheme %q", u.Scheme)
}
s.upstreams[u.Scheme] = u
}
if err := s.parseIMAPUpstream(); err != nil {
return nil, err
}
if err := s.parseSMTPUpstream(); err != nil {
return nil, err
}
2020-02-11 17:39:52 +00:00
s.Sessions = newSessionManager(s.dialIMAP, s.dialSMTP, e.Logger, options.Debug)
return s, nil
}
func (s *Server) Close() {
s.Sessions.Close()
}
func parseUpstream(s string) (*url.URL, error) {
if !strings.ContainsAny(s, ":/") {
// This is a raw domain name, make it an URL with an empty scheme
s = "//" + s
}
return url.Parse(s)
}
type NoUpstreamError struct {
schemes []string
}
func (err *NoUpstreamError) Error() string {
return fmt.Sprintf("no upstream server configured for schemes %v", err.schemes)
}
// Upstream retrieves the configured upstream server URL for the provided
// schemes. If no configured upstream server matches, a *NoUpstreamError is
// returned. An empty URL.Scheme means that the caller needs to perform
// auto-discovery with URL.Host.
2020-01-20 12:22:18 +00:00
func (s *Server) Upstream(schemes ...string) (*url.URL, error) {
var urls []*url.URL
for _, scheme := range append(schemes, "") {
u, ok := s.upstreams[scheme]
if ok {
urls = append(urls, u)
}
}
if len(urls) == 0 {
return nil, &NoUpstreamError{schemes}
}
if len(urls) > 1 {
return nil, fmt.Errorf("multiple upstream servers are configured for schemes %v", schemes)
}
return urls[0], nil
}
func (s *Server) parseIMAPUpstream() error {
u, err := s.Upstream("imap", "imaps", "imap+insecure")
2019-12-02 16:24:19 +00:00
if err != nil {
return fmt.Errorf("failed to parse upstream IMAP server: %v", err)
2019-12-02 16:24:19 +00:00
}
if u.Scheme == "" {
u, err = discoverIMAP(u.Host)
if err != nil {
return fmt.Errorf("failed to discover IMAP server: %v", err)
}
}
2019-12-02 16:24:19 +00:00
switch u.Scheme {
case "imaps":
2019-12-02 16:24:19 +00:00
s.imap.tls = true
case "imap+insecure":
s.imap.insecure = true
2020-02-12 15:15:18 +00:00
}
s.imap.host = u.Host
if !strings.ContainsRune(s.imap.host, ':') {
if u.Scheme == "imaps" {
s.imap.host += ":993"
} else {
s.imap.host += ":143"
}
2019-12-03 14:21:59 +00:00
}
c, err := s.dialIMAP()
if err != nil {
return fmt.Errorf("failed to connect to IMAP server: %v", err)
}
c.Close()
s.e.Logger.Printf("Configured upstream IMAP server: %v", u)
2019-12-03 14:21:59 +00:00
return nil
}
func (s *Server) parseSMTPUpstream() error {
u, err := s.Upstream("smtp", "smtps", "smtp+insecure")
if _, ok := err.(*NoUpstreamError); ok {
return nil
} else if err != nil {
return fmt.Errorf("failed to parse upstream SMTP server: %v", err)
2019-12-03 14:21:59 +00:00
}
if u.Scheme == "" {
u, err = discoverSMTP(u.Host)
if err != nil {
s.e.Logger.Printf("Failed to discover SMTP server: %v", err)
return nil
}
}
2019-12-03 14:21:59 +00:00
switch u.Scheme {
case "smtps":
2019-12-03 14:21:59 +00:00
s.smtp.tls = true
case "smtp+insecure":
s.smtp.insecure = true
2020-02-12 15:15:18 +00:00
}
s.smtp.host = u.Host
if !strings.ContainsRune(s.smtp.host, ':') {
if u.Scheme == "smtps" {
s.smtp.host += ":465"
} else {
s.smtp.host += ":587"
}
2019-12-02 16:24:19 +00:00
}
c, err := s.dialSMTP()
if err != nil {
return fmt.Errorf("failed to connect to SMTP server: %v", err)
}
c.Close()
s.e.Logger.Printf("Configured upstream SMTP server: %v", u)
2019-12-03 14:21:59 +00:00
return nil
}
func (s *Server) load() error {
var plugins []Plugin
for _, load := range pluginLoaders {
l, err := load(s)
if err != nil {
return fmt.Errorf("failed to load plugins: %v", err)
}
for _, p := range l {
s.e.Logger.Printf("Loaded plugin %q", p.Name())
}
plugins = append(plugins, l...)
}
renderer := newRenderer(s.e.Logger, s.Options.Theme)
if err := renderer.Load(plugins); err != nil {
return fmt.Errorf("failed to load templates: %v", err)
}
// Once we've loaded plugins and templates from disk (which can take time),
// swap them in the Server struct
s.mutex.Lock()
defer s.mutex.Unlock()
// Close previous plugins
for _, p := range s.plugins {
2020-01-10 16:00:34 +00:00
if err := p.Close(); err != nil {
s.e.Logger.Printf("Failed to unload plugin %q: %v", p.Name(), err)
2020-01-10 16:00:34 +00:00
}
}
s.plugins = plugins
s.e.Renderer = renderer
for _, p := range plugins {
p.SetRoutes(s.e.Group(""))
}
return nil
}
// Reload loads Lua plugins and templates from disk.
func (s *Server) Reload() error {
s.e.Logger.Printf("Reloading server")
return s.load()
}
2020-01-20 21:03:05 +00:00
// Logger returns this server's logger.
func (s *Server) Logger() echo.Logger {
return s.e.Logger
}
// Context is the context used by HTTP handlers.
//
// Use a type assertion to get it from a echo.Context:
//
2020-05-13 12:07:44 +00:00
// ctx := ectx.(*alps.Context)
type Context struct {
2019-12-02 16:24:19 +00:00
echo.Context
Server *Server
2019-12-11 14:24:39 +00:00
Session *Session // nil if user isn't logged in
2019-12-02 16:24:19 +00:00
}
var aLongTimeAgo = time.Unix(233431200, 0)
2019-12-11 14:24:39 +00:00
// SetSession sets a cookie for the provided session. Passing a nil session
// unsets the cookie.
func (ctx *Context) SetSession(s *Session) {
2019-12-02 16:24:19 +00:00
cookie := http.Cookie{
2019-12-03 10:12:26 +00:00
Name: cookieName,
2019-12-02 16:24:19 +00:00
HttpOnly: true,
2020-11-05 15:35:27 +00:00
SameSite: http.SameSiteStrictMode,
Secure: ctx.IsTLS(),
2019-12-02 16:24:19 +00:00
}
if s != nil {
cookie.Value = s.token
} else {
2019-12-02 16:24:19 +00:00
cookie.Expires = aLongTimeAgo // unset the cookie
}
ctx.SetCookie(&cookie)
2019-12-02 16:24:19 +00:00
}
type loginToken struct {
Username string
Password string
}
func (ctx *Context) SetLoginToken(username, password string) {
cookie := http.Cookie{
Expires: time.Now().Add(30 * 24 * time.Hour),
Name: loginTokenCookieName,
HttpOnly: true,
2020-11-05 15:35:27 +00:00
SameSite: http.SameSiteStrictMode,
Secure: ctx.IsTLS(),
Path: "/login",
}
if username == "" {
cookie.Expires = aLongTimeAgo // unset the cookie
ctx.SetCookie(&cookie)
return
}
loginToken := loginToken{username, password}
payload, err := json.Marshal(loginToken)
if err != nil {
panic(err) // Should never happen
}
fkey := ctx.Server.Options.LoginKey
if fkey == nil {
return
}
bytes, err := fernet.EncryptAndSign(payload, fkey)
if err != nil {
log.Printf("Warning: login token encryption failed: %v", err)
return
}
cookie.Value = string(bytes)
ctx.SetCookie(&cookie)
}
func (ctx *Context) GetLoginToken() (string, string) {
cookie, err := ctx.Cookie(loginTokenCookieName)
if err != nil || cookie == nil {
return "", ""
}
fkey := ctx.Server.Options.LoginKey
if fkey == nil {
return "", ""
}
bytes := fernet.VerifyAndDecrypt([]byte(cookie.Value),
2020-05-20 17:08:06 +00:00
24*time.Hour*30, []*fernet.Key{fkey})
if bytes == nil {
return "", ""
}
var token loginToken
err = json.Unmarshal(bytes, &token)
if err != nil {
panic(err) // Should never happen
}
return token.Username, token.Password
}
func isPublic(path string) bool {
if strings.HasPrefix(path, "/plugins/") {
parts := strings.Split(path, "/")
return len(parts) >= 4 && parts[3] == "assets"
}
return path == "/login" || strings.HasPrefix(path, "/themes/")
}
2020-01-10 16:29:37 +00:00
func redirectToLogin(ctx *Context) error {
path := ctx.Request().URL.Path
to := "/login"
if path != "/" && path != "/login" {
to += "?next=" + url.QueryEscape(ctx.Request().URL.String())
}
return ctx.Redirect(http.StatusFound, to)
}
func handleUnauthenticated(next echo.HandlerFunc, ctx *Context) error {
// Require auth for all requests except /login and assets
if isPublic(ctx.Request().URL.Path) {
return next(ctx)
} else {
return redirectToLogin(ctx)
}
}
type Options struct {
Upstreams []string
Theme string
2020-02-11 17:39:52 +00:00
Debug bool
LoginKey *fernet.Key
}
2019-12-02 16:24:19 +00:00
2019-12-11 14:24:39 +00:00
// New creates a new server.
func New(e *echo.Echo, options *Options) (*Server, error) {
s, err := newServer(e, options)
2019-12-02 16:24:19 +00:00
if err != nil {
return nil, err
}
if err := s.load(); err != nil {
return nil, err
2019-12-09 15:02:12 +00:00
}
2019-12-03 12:17:51 +00:00
e.HTTPErrorHandler = func(err error, c echo.Context) {
code := http.StatusInternalServerError
if he, ok := err.(*echo.HTTPError); ok {
code = he.Code
} else {
c.Logger().Error(err)
}
// TODO: hide internal errors
c.String(code, err.Error())
}
e.Pre(func(next echo.HandlerFunc) echo.HandlerFunc {
return func(ectx echo.Context) error {
s.mutex.RLock()
err := next(ectx)
s.mutex.RUnlock()
return err
}
})
e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
return func(ectx echo.Context) error {
2019-12-18 12:53:45 +00:00
// `style-src 'unsafe-inline'` is required for e-mails with
// embedded stylesheets
ectx.Response().Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'")
2020-01-20 17:26:22 +00:00
// DNS prefetching has privacy implications
ectx.Response().Header().Set("X-DNS-Prefetch-Control", "off")
return next(ectx)
}
})
2019-12-02 16:24:19 +00:00
e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
return func(ectx echo.Context) error {
ctx := &Context{Context: ectx, Server: s}
2019-12-09 15:02:12 +00:00
ctx.Set("context", ctx)
2019-12-02 16:24:19 +00:00
cookie, err := ctx.Cookie(cookieName)
if err == http.ErrNoCookie {
2020-01-10 16:29:37 +00:00
return handleUnauthenticated(next, ctx)
2019-12-02 16:24:19 +00:00
} else if err != nil {
return err
}
ctx.Session, err = ctx.Server.Sessions.get(cookie.Value)
2020-11-19 14:27:59 +00:00
if err == ErrSessionExpired {
ctx.SetSession(nil)
2020-01-10 16:29:37 +00:00
return handleUnauthenticated(next, ctx)
2019-12-02 16:24:19 +00:00
} else if err != nil {
return err
}
ctx.Session.ping()
2019-12-02 16:24:19 +00:00
return next(ctx)
}
})
e.Static("/themes", "themes")
2019-12-02 14:31:00 +00:00
return s, nil
2019-12-02 14:31:00 +00:00
}