arminius_server_client/handlers/

test_login.rs

// SPDX-FileCopyrightText: 2025 BWI GmbH
//
// SPDX-License-Identifier: Apache-2.0

//! Insecure registration and login endpoints for testing with Complement and
//! friends.

#![allow(
	clippy::allow_attributes,
	reason = "This source file contains enums which allow `clippy::missing_docs_in_private_items`. But an exception to this lint will mistakenly report that it's unfulfilled when used with expect, even though it is not."
)]

mod tests;

use std::fmt::Debug;

use arminius_lib_authentication::test_utils::generate_auth_token;
use arminius_lib_component::{
	Component, ServerState,
	error::{FeatureNotImplemented, InternalServerError, MatrixApiError, ResultExt as _},
	request_source::RequestSource,
	ruma_requests::ArminiusResponse,
};
use arminius_lib_db::Database;
use arminius_lib_db_devices::DeviceQueries as _;
use arminius_lib_db_keys::UserKeysQueries as _;
use arminius_lib_db_user::{InsertUserError, UserQueries as _};
use arminius_lib_macros::FromDbError;
use axum::{
	Router,
	extract::State,
	http::StatusCode,
	response::IntoResponse,
	routing::{get, post},
};
use ruma::{
	DeviceId, OwnedDeviceId, OwnedUserId, UserId,
	api::{
		client::{
			account::{self, get_username_availability},
			session::{
				self,
				get_login_types::{
					self,
					v3::{LoginType, PasswordLoginType},
				},
				login::v3::LoginInfo,
			},
			uiaa::{AuthFlow, AuthType, UiaaInfo, UiaaResponse, UserIdentifier},
		},
		error::ErrorKind,
	},
	user_id::localpart_is_fully_conforming,
};

use crate::client_request::{AppserviceTokenOptionalClientRequest, UnauthenticatedClientRequest};

#[allow(
	missing_docs,
	clippy::missing_docs_in_private_items,
	reason = "TODO(#2003): This exception predates us enabling `clippy::allow_attributes_without_reason`, so we don't know why it was enabled"
)]
#[derive(Debug, thiserror::Error, MatrixApiError, FromDbError)]
enum LoginError {
	#[error(transparent)]
	FeatureNotImplemented(#[from] FeatureNotImplemented),

	/// Error thrown when the username does not comply with the specs (See
	/// <https://spec.matrix.org/v1.15/appendices/#user-identifiers>).
	#[error("Provided username is invalid.")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::InvalidUsername)]
	InvalidUsername,

	/// Error thrown when the username is missing in a request.
	#[error("Missing required username")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::MissingParam)]
	MissingUsername,

	/// Error thrown when the given device ID is invalid. For now, this can only
	/// be the case if it is the same as one of the user's cross-signing key's
	/// ID (See <https://spec.matrix.org/v1.16/client-server-api/#key-and-signature-security>).
	#[error("Invalid device ID")]
	#[matrix_api_error(status_code = StatusCode::FORBIDDEN, error_kind = ErrorKind::Forbidden)]
	InvalidDeviceId,

	/// Error thrown when the credentials to login are invalid.
	#[error("Invalid credentials")]
	#[matrix_api_error(status_code = StatusCode::FORBIDDEN, error_kind = ErrorKind::Forbidden)]
	UnauthorizedLogin,

	/// Error thrown when the desired user ID is already taken.
	#[error("Desired user ID is already taken.")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::UserInUse)]
	UserInUse,

	/// Error thrown when the desired user ID is already taken.
	#[error("Missing session in UIA request")]
	#[matrix_api_error(status_code = StatusCode::UNAUTHORIZED, error_kind = ErrorKind::MissingParam)]
	MissingSession,

	#[error(transparent)]
	InternalServerError(#[from] InternalServerError),
}

/// Tries at most 3 times to generate a new [DeviceId] that does not conflict
/// with the given `forbidden_ids`.
fn try_generate_device_id(forbidden_ids: &[String]) -> Option<OwnedDeviceId> {
	for _ in 0..3 {
		let device_id = DeviceId::new();

		if forbidden_ids.iter().any(|id| id.as_str() == device_id.as_str()) {
			continue;
		}

		return Some(device_id);
	}

	None
}

/// Create a session, optionally with a user-provided device ID.
///
/// For more information about device IDs, see
/// <https://spec.matrix.org/v1.14/client-server-api/#post_matrixclientv3login>
#[tracing::instrument(skip(database))]
async fn create_session(
	database: &mut impl Database,
	user_id: OwnedUserId,
	device_id: Option<OwnedDeviceId>,
) -> Result<(OwnedDeviceId, String), LoginError> {
	let cross_signing_keys_ids = database.fetch_cross_signing_keys_ids_for_user(&user_id).await?;

	let device_id = match device_id {
		Some(device_id) => {
			if cross_signing_keys_ids.iter().any(|id| id.as_str() == device_id.as_str()) {
				return Err(LoginError::InvalidDeviceId);
			}

			device_id
		}
		None => try_generate_device_id(&cross_signing_keys_ids)
			.unrecoverable_error("Failed generating a new device ID")?,
	};

	// Should be an upsert, but all this code is targeted for the bin anyway
	if database.fetch_device_for_user(&user_id, &device_id).await?.is_none() {
		database.insert_device_for_user(&user_id, &device_id).await?;
	};

	let access_token = generate_auth_token(&user_id, &device_id)
		.unrecoverable_error("Generating authentication token")?;

	Ok((device_id, access_token))
}

/// A response to a registration - either the registration is successful, or we still require
/// user-interactive authentication.
enum RegisterResponse {
	/// Normal response
	NormalResponse(account::register::v3::Response),
	/// User-interactive authentication is required
	UiaaResponse(UiaaResponse),
}

impl IntoResponse for RegisterResponse {
	fn into_response(self) -> axum::response::Response {
		match self {
			RegisterResponse::NormalResponse(response) => {
				ArminiusResponse(response).into_response()
			}
			RegisterResponse::UiaaResponse(response) => ArminiusResponse(response).into_response(),
		}
	}
}

impl From<account::register::v3::Response> for RegisterResponse {
	fn from(value: account::register::v3::Response) -> Self {
		RegisterResponse::NormalResponse(value)
	}
}

impl From<UiaaResponse> for RegisterResponse {
	fn from(value: UiaaResponse) -> Self {
		RegisterResponse::UiaaResponse(value)
	}
}

/// Handler for `POST /_matrix/client/v3/register` (See
/// <https://spec.matrix.org/latest/client-server-api/#post_matrixclientv3register>).
///
/// Endpoint used to register a new matrix user.
async fn register_handler(
	mut state: State<ServerState>,
	RequestSource(source): RequestSource,
	AppserviceTokenOptionalClientRequest(request): AppserviceTokenOptionalClientRequest<
		account::register::v3::Request,
	>,
) -> Result<RegisterResponse, LoginError> {
	tracing::info!("Registering user with address {source:?}");

	let user_id = match request.username.clone() {
		Some(localpart) => {
			let localpart = localpart.to_lowercase();
			if localpart_is_fully_conforming(&localpart) != Ok(true) {
				return Err(LoginError::InvalidUsername);
			}
			UserId::parse_with_server_name(localpart, &state.config.server_name)
				.map_err(|_| LoginError::InvalidUsername)?
		}
		None => UserId::new(&state.config.server_name),
	};

	let mut transaction = state.database.begin_transaction().await?;

	// We check this before UIA to be Complement and spec compliant
	// It's not a security issue, because you can use the `/register/available` endpoint the same
	// way anyway.
	if transaction.fetch_user(&user_id).await?.is_some() {
		return Err(LoginError::UserInUse);
	}

	// We implement a dummy version of the user-interactive authentication API when performing
	// registration. We don't actually implement m.login.dummy. What we have is a dummy
	// implementation of m.login.dummy. :D
	//
	// We just implement this because the `register` function in Complement expects to be turned
	// away with a 401 first time it attempts to register.
	match request.auth {
		None => {
			let mut info = UiaaInfo::new(vec![AuthFlow::new(vec![AuthType::Dummy])]);
			info.session =
				Some("Want to come to my 62nd birthay? It'll only take a minute.".to_owned());
			let response = UiaaResponse::AuthResponse(info);
			return Ok(response.into());
		}
		// We just do this one check to pass a Complement test.
		// Arguably, what's the point?
		Some(ruma::api::client::uiaa::AuthData::Dummy(dummy)) if dummy.session.is_none() => {
			return Err(LoginError::MissingSession);
		}
		_ => {
			// If any sort of `auth` data is included, we accept it.
		}
	}

	transaction.insert_new_user(&user_id, request.username.as_deref()).await.map_err(
		|error| -> LoginError {
			match error {
				InsertUserError::UserIdTaken => LoginError::UserInUse,
				InsertUserError::DatabaseError(error) => error.into(),
			}
		},
	)?;

	let (device_id, access_token) =
		create_session(&mut transaction, user_id.clone(), request.device_id)
			.await
			.unrecoverable_error("Creating session")?;

	transaction.commit().await?;

	let mut response = account::register::v3::Response::new(user_id);
	response.device_id = Some(device_id);
	response.access_token = Some(access_token);
	Ok(response.into())
}

/// Handler for `POST /_matrix/client/v3/login` (See
/// <https://spec.matrix.org/latest/client-server-api/#post_matrixclientv3login>).
///
/// Endpoint used to sign-in a Matrix user.
///
/// Warning: Does not check whether the password is correct.
async fn login_handler(
	mut state: State<ServerState>,
	RequestSource(source): RequestSource,
	AppserviceTokenOptionalClientRequest(request): AppserviceTokenOptionalClientRequest<
		session::login::v3::Request,
	>,
) -> Result<ArminiusResponse<session::login::v3::Response>, LoginError> {
	tracing::info!("Logging in user with address {source:?}");
	let LoginInfo::Password(login_info) = request.login_info else {
		return Err(FeatureNotImplemented("Non-password login".to_owned()).into());
	};

	let Some(localpart) = login_info.identifier else {
		return Err(LoginError::MissingUsername);
	};

	let UserIdentifier::Matrix(localpart) = localpart else {
		return Err(FeatureNotImplemented("You can only sign in with usernames".to_owned()).into());
	};

	let user_id = UserId::parse_with_server_name(localpart.user, &state.config.server_name)
		.map_err(|_| LoginError::InvalidUsername)?;

	let (device_id, access_token) =
		create_session(&mut state.database, user_id.clone(), request.device_id)
			.await
			.map_err(|_| LoginError::UnauthorizedLogin)?;

	Ok(session::login::v3::Response::new(user_id, access_token, device_id).into())
}

/// Handler for `GET /_matrix/client/v3/login` (See
/// <https://spec.matrix.org/latest/client-server-api/#get_matrixclientv3login>).
///
/// Endpoint used to list the permitted login types.
async fn get_login_types_handler() -> ArminiusResponse<get_login_types::v3::Response> {
	get_login_types::v3::Response::new(vec![LoginType::Password(PasswordLoginType::new())]).into()
}

/// Error type for `get_username_availability_handler`
#[derive(Debug, thiserror::Error, MatrixApiError, FromDbError)]
enum GetUsernameAvailabilityError {
	/// Unrecoverable error.
	/// See <https://bundesmessenger.gitlab.io/backend/neo/arminius/arminius/03-development/errors.html#unrecoverable-errors>
	#[error(transparent)]
	InternalServerError(#[from] InternalServerError),
	/// Could not parse user ID we're checking for availability
	#[error("Username is already taken")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::UserInUse)]
	UserInUse,
	/// Could not parse user ID we're checking for availability
	#[error("Could not parse user ID: {0}")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::InvalidUsername)]
	IdParseError(#[from] ruma::IdParseError),
}

/// Handler for `GET /_matrix/client/v3/register/available` (See
/// <https://spec.matrix.org/latest/client-server-api/#get_matrixclientv3registeravailable>).
///
/// Endpoint which lets you check whether a username is available
async fn get_username_availability_handler(
	mut state: State<ServerState>,
	UnauthenticatedClientRequest(request): UnauthenticatedClientRequest<
		get_username_availability::v3::Request,
	>,
) -> Result<ArminiusResponse<get_username_availability::v3::Response>, GetUsernameAvailabilityError>
{
	let username = UserId::parse_with_server_name(request.username, &state.config.server_name)?;
	username.validate_strict()?;
	if state.database.fetch_user(&username).await?.is_some() {
		return Err(GetUsernameAvailabilityError::UserInUse);
	}
	Ok(get_username_availability::v3::Response::new(true).into())
}

/// Component for insecure login endpoint
#[derive(Debug)]
pub struct TestLoginComponent;

impl Component for TestLoginComponent {
	fn router() -> Router<ServerState> {
		Router::new()
			.route("/_matrix/client/v3/register", post(register_handler))
			.route("/_matrix/client/v3/register/available", get(get_username_availability_handler))
			.route("/_matrix/client/v3/login", get(get_login_types_handler).post(login_handler))
	}
}