guichet/models/passwd.go

/*
gpas is GVoisin password reset
*/

package models

import (
	"bytes"
	"errors"
	"fmt"
	"html/template"
	"log"
	"math/rand"

	// "github.com/emersion/go-sasl"
	// "github.com/emersion/go-smtp"
	"net/smtp"

	"github.com/go-ldap/ldap/v3"

	// "strings"
	b64 "encoding/base64"
)

var templatePath = "./templates"

type CodeMailFields struct {
	From           string
	To             string
	Code           string
	InviteFrom     string
	WebBaseAddress string
	Common         NestedCommonTplData
}
type NestedCommonTplData struct {
	Error          string
	ErrorMessage   string
	CanAdmin       bool
	CanInvite      bool
	LoggedIn       bool
	Success        bool
	WarningMessage string
	WebsiteName    string
	WebsiteURL     string
}
// type InvitationAccount struct {
// 	UID string
// 	Password string
// 	BaseDN string
// }

// Suggesting a 12 char password with some excentrics
func SuggestPassword() string {
	password := ""
	chars := "abcdfghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%&*+_-="
	for i := 0; i < 12; i++ {
		password += string([]rune(chars)[rand.Intn(len(chars))])
	}
	return password
}

// var EMAIL_REGEXP := regexp.MustCompile("^[a-zA-Z0-9.!#$%&'*+\\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$")

func getInvitationBaseDN(config *ConfigFile) string {
	return config.InvitationBaseDN
}

func PasswordLost(user User, config *ConfigFile, ldapConn *ldap.Conn) error {
	if user.CN == "" && user.Mail == "" && user.OtherMailbox == "" {
		return errors.New("Il n'y a pas de quoi identifier l'utilisateur")
	}
	searchFilter := "(|"
	if user.CN != "" {
		searchFilter += "(cn=" + user.UID + ")"
	}
	if user.Mail != "" {
		searchFilter += "(mail=" + user.Mail + ")"
	}
	if user.OtherMailbox != "" {
		searchFilter += "(carLicense=" + user.OtherMailbox + ")"
	}
	searchFilter += ")"
	searchReq := ldap.NewSearchRequest(config.UserBaseDN, ldap.ScopeSingleLevel, ldap.NeverDerefAliases, 0, 0, false, searchFilter, []string{"cn", "uid", "mail", "carLicense", "sn", "displayName", "givenName"}, nil)
	searchRes, err := ldapConn.Search(searchReq)
	if err != nil {
		log.Printf("PasswordLost search : %v %v", err, ldapConn)
		log.Printf("PasswordLost search : %v", searchReq)
		log.Printf("PasswordLost search : %v", searchRes)
		log.Printf("PasswordLost search: %v", user)
		return err
	}
	if len(searchRes.Entries) == 0 {
		log.Printf("Il n'y a pas d'utilisateur qui correspond %v", searchReq)
		return errors.New("Il n'y a pas d'utilisateur qui correspond")
	}
	// log.Printf("PasswordLost 58 : %v", user)
	// log.Printf("PasswordLost 59 : %v", searchRes.Entries[0])
	// log.Printf("PasswordLost 60 : %v", searchRes.Entries[0].GetAttributeValue("cn"))
	// log.Printf("PasswordLost 61 : %v", searchRes.Entries[0].GetAttributeValue("uid"))
	// log.Printf("PasswordLost 62 : %v", searchRes.Entries[0].GetAttributeValue("mail"))
	// log.Printf("PasswordLost 63 : %v", searchRes.Entries[0].GetAttributeValue("carLicense"))
	// Préparation du courriel à envoyer

	delReq := ldap.NewDelRequest("uid="+searchRes.Entries[0].GetAttributeValue("cn")+","+config.InvitationBaseDN, nil)
	err = ldapConn.Del(delReq)

	user.Password = SuggestPassword()
	user.DN = "uid=" + searchRes.Entries[0].GetAttributeValue("cn") + "," + config.InvitationBaseDN
	user.UID = searchRes.Entries[0].GetAttributeValue("cn")
	user.CN = searchRes.Entries[0].GetAttributeValue("cn")
	user.Mail = searchRes.Entries[0].GetAttributeValue("mail")
	user.OtherMailbox = searchRes.Entries[0].GetAttributeValue("carLicense")
	code := b64.URLEncoding.EncodeToString([]byte(user.UID + ";" + user.Password))
	/* Check for outstanding invitation */
	searchReq = ldap.NewSearchRequest(config.InvitationBaseDN, ldap.ScopeSingleLevel,
		ldap.NeverDerefAliases, 0, 0, false, "(uid="+user.UID+")", []string{"seeAlso"}, nil)
	searchRes, err = ldapConn.Search(searchReq)
	if err != nil {
		log.Printf(fmt.Sprintf("PasswordLost (Check existing invitation) : %v", err))
		log.Printf(fmt.Sprintf("PasswordLost (Check existing invitation) : %v", user))
		return err
	}
	// if len(searchRes.Entries) == 0 {
	/* Add the invitation */
	addReq := ldap.NewAddRequest(
		"uid="+user.UID+","+config.InvitationBaseDN,
		nil)
	addReq.Attribute("objectClass", []string{"top", "account", "simpleSecurityObject"})
	addReq.Attribute("uid", []string{user.UID})
	addReq.Attribute("userPassword", []string{user.Password})
	addReq.Attribute("seeAlso", []string{config.UserNameAttr + "=" + user.UID + "," + config.UserBaseDN})
	// Password invitation may already exist

	//
	err = ldapConn.Add(addReq)
	if err != nil {
		log.Printf("PasswordLost 83 : %v", err)
		log.Printf("PasswordLost 84 : %v", user)

		log.Printf("PasswordLost 84 : %v", addReq)
		// // log.Printf("PasswordLost 85 : %v", searchRes.Entries[0]))
		// // For some reason I get here even if the entry exists already
		// return err
	}
	// }
	ldapNewConn, err := OpenNewUserLdap(config)
	if err != nil {
		log.Printf("PasswordLost OpenNewUserLdap : %v", err)
	}
	err = PassWD(user, config, ldapNewConn)
	if err != nil {
		log.Printf("PasswordLost PassWD : %v", err)
		log.Printf("PasswordLost PassWD : %v", user)
		log.Printf("PasswordLost PassWD : %v", searchRes.Entries[0])
		return err
	}
	templateMail := template.Must(template.ParseFiles(templatePath + "/passwd/lost_password_email.txt"))
	buf := bytes.NewBuffer([]byte{})
	templateMail.Execute(buf, &CodeMailFields{
		To:             user.OtherMailbox,
		From:           config.MailFrom,
		InviteFrom:     user.UID,
		Code:           code,
		WebBaseAddress: config.WebAddress,
	})
	// message := []byte("Hi " + user.OtherMailbox)
	log.Printf("Sending mail to: %s", user.OtherMailbox)
	// var auth sasl.Client = nil
	// if config.SMTPUsername != "" {
	// 	auth = sasl.NewPlainClient("", config.SMTPUsername, config.SMTPPassword)
	// }
	message := buf.Bytes()
	auth := smtp.PlainAuth("", config.SMTPUsername, config.SMTPPassword, config.SMTPServer)
	log.Printf("auth: %v", auth)
	err = smtp.SendMail(config.SMTPServer+":587", auth, config.SMTPUsername, []string{user.OtherMailbox}, message)
	if err != nil {
		log.Printf("email send error %v", err)
		return err
	}
	log.Printf("Mail sent.")
	return err
}

func PasswordFound(user User, config *ConfigFile, ldapConn *ldap.Conn) (string, error) {
	l, err := openLdap(config)
	if err != nil {
		log.Printf("PasswordFound openLdap %v", err)
		// log.Printf("PasswordFound openLdap Config : %v", config)
		return "", err
	}
	if user.DN == "" && user.UID != "" {
		user.DN = "uid=" + user.UID + "," + config.InvitationBaseDN
	}
	err = l.Bind(user.DN, user.Password)
	if err != nil {
		log.Printf("PasswordFound l.Bind %v", err)
		log.Printf("PasswordFound l.Bind %v", user.DN)
		log.Printf("PasswordFound l.Bind %v", user.UID)
		return "", err
	}
	searchReq := ldap.NewSearchRequest(user.DN, ldap.ScopeBaseObject,
		ldap.NeverDerefAliases, 0, 0, false, "(uid="+user.UID+")", []string{"seeAlso"}, nil)
	var searchRes *ldap.SearchResult
	searchRes, err = ldapConn.Search(searchReq)
	if err != nil {
		log.Printf("PasswordFound %v", err)
		log.Printf("PasswordFound %v", searchReq)
		log.Printf("PasswordFound %v", ldapConn)
		log.Printf("PasswordFound %v", searchRes)
		return "", err
	}
	if len(searchRes.Entries) == 0 {
		log.Printf("PasswordFound %v", err)
		log.Printf("PasswordFound %v", searchReq)
		log.Printf("PasswordFound %v", ldapConn)
		log.Printf("PasswordFound %v", searchRes)
		return "", err
	}
	delReq := ldap.NewDelRequest("uid="+user.CN+","+config.InvitationBaseDN, nil)
	ldapConn.Del(delReq)
	return searchRes.Entries[0].GetAttributeValue("seeAlso"), err
}